Analysis Report SecuriteInfo.com.Trojan.MulDrop15.61981.23282.23831

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.MulDrop15.61981.23282.23831 (renamed file extension from 23831 to exe)
Analysis ID:	323821
MD5:	b7679c443e22238291f5603f016ff56e
SHA1:	8e17bee5c61b8383a3ad6f16701a204a62f6d05a
SHA256:	be48a66b718f94c2379453ff845e0047504573e3c0e1a9f7ab3011dab1c06b57
Tags:	AgentTesla
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Modifies the hosts file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.6956.4.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "7C1PT6er97z7if", "URL: ": "http://9346p4IyJGSfBUnad7m.com", "To: ": "j.koskela@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "ZBKqjHkUYjIYCut", "From: ": "j.koskela@yandex.com"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Virustotal: Detection: 32%			Perma Link
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	ReversingLabs: Detection: 31%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 4.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 15.2.vlc.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Networking:

May check the online IP address of the machine

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 54.235.142.93 54.235.142.93
Source: Joe Sandbox View	IP Address: 54.235.142.93 54.235.142.93

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS traffic detected: queries for: g.msn.com

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513567379.0000000003783000.00000004.00000001.sdmp	String found in binary or memory: http://9346p4IyJGSfBUnad7m.=
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511664403.0000000003506000.00000004.00000001.sdmp	String found in binary or memory: http://9346p4IyJGSfBUnad7m.com
Source: vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.509928930.0000000001763000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.509928930.0000000001763000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationR5
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511543091.00000000034EB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.243783276.00000000053FD000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.243783276.00000000053FD000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comh
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511543091.00000000034EB000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.509928930.0000000001763000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: http://pYJvKF.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ycasha2.cer0
Source: vlc.exe	String found in binary or memory: http://schemas.microso
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246769951.00000000053C3000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246384080.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246769951.00000000053C3000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246769951.00000000053C3000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comT
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246769951.00000000053C3000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comt
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html(
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comW.TTF
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.281706001.00000000053C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdia
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdma
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.281706001.00000000053C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comldF
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.249917158.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.281706001.00000000053C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245953813.00000000053C7000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245508386.00000000053C6000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245508386.00000000053C6000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245953813.00000000053C7000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245953813.00000000053C7000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnT
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.253825973.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.253563878.00000000053E9000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245272016.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-iY
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.247140678.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/C
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.247140678.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/L
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.247934088.00000000053CE000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245272016.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krP
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245272016.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krcomimB
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245272016.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kre
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245272016.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krorm
Source: vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245968295.00000000053C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com;
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.245906224.00000000053CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.como2jr
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.244030655.00000000053FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.244129486.00000000053FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net1
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.244407765.00000000053FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.nets
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.244129486.00000000053FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netu
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.283257861.00000000065D2000.00000004.00000001.sdmp, vlc.exe, 0000000C.00000002.332573233.0000000005AD0000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.337484757.0000000006220000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246384080.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnH
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000003.246384080.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnue
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.ocsp-responder.com03
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org/
Source: vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.278541808.0000000002522000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.505759683.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000C.00000002.327896821.0000000003B91000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.505733020.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	String found in binary or memory: https://discord.com/
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	String found in binary or memory: https://discord.com/4
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	String found in binary or memory: https://discord.com/8
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511543091.00000000034EB000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.513449154.0000000003776000.00000004.00000001.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.278541808.0000000002522000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.505759683.0000000000402000.00000040.00000001.sdmp, vlc.exe, 0000000C.00000002.327896821.0000000003B91000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.505733020.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp, vlc.exe, 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443

Spam, unwanted Advertisements and Ransom Demands:

Modifies the hosts file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe

File written: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_00A4C284	1_2_00A4C284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_00A4E640	1_2_00A4E640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_00A4E650	1_2_00A4E650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_06ACC6F8	1_2_06ACC6F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_06ACBE28	1_2_06ACBE28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_06ACBAE0	1_2_06ACBAE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_01944800	4_2_01944800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_019447B3	4_2_019447B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_019447F3	4_2_019447F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_05F57538	4_2_05F57538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_05F594F8	4_2_05F594F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_05F56C68	4_2_05F56C68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072D0346	4_2_072D0346
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072D5E28	4_2_072D5E28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072D7228	4_2_072D7228
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072D9AB0	4_2_072D9AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072DE938	4_2_072DE938
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072DA420	4_2_072DA420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_05F52670	4_2_05F52670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_05F52602	4_2_05F52602
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_0297C284	12_2_0297C284
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_0297E650	12_2_0297E650
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_0297E640	12_2_0297E640
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEC6F8	12_2_06DEC6F8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEBE28	12_2_06DEBE28
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEDD88	12_2_06DEDD88
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEBAE0	12_2_06DEBAE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E5BE48	12_2_06E5BE48
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E54AEE	12_2_06E54AEE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E54AF0	12_2_06E54AF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E50B40	12_2_06E50B40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E508C8	12_2_06E508C8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E508BB	12_2_06E508BB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E5094B	12_2_06E5094B

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.278541808.0000000002522000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClassLibrary3.dll< vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.278541808.0000000002522000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCulVFjlhGnGAyXhkxkWFpnyXNQrnUykLXhR.exe4 vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.277018085.0000000000062000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename0mrxdv.exe` vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000001.00000002.278801335.0000000003481000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameXmbmldyr.dll4 vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000003.00000002.273934328.0000000000192000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename0mrxdv.exe` vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.508942062.000000000168A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.505759683.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCulVFjlhGnGAyXhkxkWFpnyXNQrnUykLXhR.exe4 vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.506619680.0000000000F62000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename0mrxdv.exe` vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.517916958.0000000006C40000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Binary or memory string: OriginalFilename0mrxdv.exe` vs SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vlc.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe'
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_00A4FAE4 pushfd ; iretd	1_2_00A4FAE5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 1_2_00A4FA10 push esp; iretd	1_2_00A4FA11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Code function: 4_2_072DE138 pushad ; retf	4_2_072DE179
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_0297FAE4 pushfd ; iretd	12_2_0297FAE5
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_0297FA10 push esp; iretd	12_2_0297FA11
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEEE10 push ebp; ret	12_2_06DEEE29
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DE2FF3 push es; iretd	12_2_06DE2FF4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DEEA7A pushfd ; retf	12_2_06DEEA81
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06DE301D push es; ret	12_2_06DE3020
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E514C1 push es; ret	12_2_06E514D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E5CA20 push eax; iretd	12_2_06E5CA21
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 12_2_06E5CA2B pushfd ; iretd	12_2_06E5CA69

Source: initial sample	Static PE information: section name: .text entropy: 7.96407261365
Source: initial sample	Static PE information: section name: .text entropy: 7.96407261365

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: vlc.exe.1.dr, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: vlc.exe.1.dr, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 1.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.60000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 1.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.60000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 1.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.60000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 1.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.60000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 3.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.190000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 3.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.190000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 3.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.190000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 3.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.190000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 4.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.f60000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 4.0.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.f60000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 4.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.f60000.1.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 4.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.f60000.1.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 12.0.vlc.exe.6e0000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 12.0.vlc.exe.6e0000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 12.2.vlc.exe.6e0000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 12.2.vlc.exe.6e0000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 13.0.vlc.exe.e30000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 13.0.vlc.exe.e30000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 13.2.vlc.exe.e30000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 13.2.vlc.exe.e30000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 15.2.vlc.exe.f70000.1.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 15.2.vlc.exe.f70000.1.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'
Source: 15.0.vlc.exe.f70000.0.unpack, yfREwUKaTD0wPBlkBE/vf8L954yCm8LZ54oRw.cs	High entropy of concatenated method names: '.ctor', 'vf84L95yC', 'e8LKZ54oR', 'xMffREwUa', 'Dispose', 'JD0bwPBlk', 'S7OVrxUB62AQ3I1qks', 'GncbsTPSNfAE8TIK6D', 'aUtu5VweCAV0DnnIK0', 'bo6cX3rUYkkkvFMWem'
Source: 15.0.vlc.exe.f70000.0.unpack, VJd1TQFmRcd4tLjE5x/AyHZGMmym37msV77u2.cs	High entropy of concatenated method names: 'D779u2QJd', 'HTQImRcd4', 'ULj7E5xy9', 'Kcgak04k9', 'xYWHES7UA', 'XNwJ4MWZ0', '.ctor', '.cctor', 'B3LXdL43xMwIjd8BJx', 'nLyOVHVla4P0mkCAhk'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe\:Zone.Identifier:$DATA	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Window / User API: threadDelayed 1538	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Window / User API: threadDelayed 8312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Window / User API: threadDelayed 2553	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Window / User API: threadDelayed 7297	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe TID: 6616	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe TID: 6632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe TID: 5516	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe TID: 320	Thread sleep count: 1538 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe TID: 320	Thread sleep count: 8312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6504	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6640	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6420	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6336	Thread sleep count: 2553 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6336	Thread sleep count: 7297 > 30	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: vlc.exe, 0000000C.00000002.326972792.0000000002B91000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.509672752.00000000016F1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A			Jump to behavior

Analysis Report SecuriteInfo.com.Trojan.MulDrop15.61981.23282.23831

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511281576.0000000001EF0000.00000002.00000001.sdmp, vlc.exe, 0000000F.00000002.509410545.0000000001DF0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511281576.0000000001EF0000.00000002.00000001.sdmp, vlc.exe, 0000000F.00000002.509410545.0000000001DF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511281576.0000000001EF0000.00000002.00000001.sdmp, vlc.exe, 0000000F.00000002.509410545.0000000001DF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe, 00000004.00000002.511281576.0000000001EF0000.00000002.00000001.sdmp, vlc.exe, 0000000F.00000002.509410545.0000000001DF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: Yara match	File source: 00000004.00000002.505759683.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.278541808.0000000002522000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.278353897.0000000002481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.511664403.0000000003506000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.327896821.0000000003B91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.511444288.00000000034B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.510701156.00000000034E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.327636226.0000000002CB6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.505733020.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.278801335.0000000003481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlc.exe PID: 2504, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe PID: 6612, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe PID: 6956, type: MEMORY
Source: Yara match	File source: Process Memory Space: vlc.exe PID: 6360, type: MEMORY
Source: Yara match	File source: 4.2.SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Name	IP	Active
elb097307-934924932.us-east-1.elb.amazonaws.com	54.235.142.93	true
smtp.yandex.ru	77.88.21.158	true
smtp.yandex.com	unknown	unknown
g.msn.com	unknown	unknown
api.ipify.org	unknown	unknown

ID:	323821
Product:	CloudBasic
Start time:	15:47:30
Start date:	27.11.2020
Sample:	SecuriteInfo.com.Trojan.MulDrop15.61981.23282.23831
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b7679c443e22238291f5603f016ff56e
SHA1:	8e17bee5c61b8383a3ad6f16701a204a62f6d05a
SHA256:	be48a66b718f94c2379453ff845e0047504573e3c0e1a9f7ab3011dab1c06b57
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe.log	ASCII text, with CRLF line terminators	E87C60A24438CC611338EA5ACB433A0A	E0C6A7D5CFE32BB2178E71DEE79971A51697B7DD	80DAB47D7A9E233A692D10ACAF5793E34911836D36DB2E11BB7C5D42DE39782A
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vlc.exe.log	ASCII text, with CRLF line terminators	E87C60A24438CC611338EA5ACB433A0A	E0C6A7D5CFE32BB2178E71DEE79971A51697B7DD	80DAB47D7A9E233A692D10ACAF5793E34911836D36DB2E11BB7C5D42DE39782A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	B7679C443E22238291F5603F016FF56E	8E17BEE5C61B8383A3AD6F16701A204A62F6D05A	BE48A66B718F94C2379453FF845E0047504573E3C0E1A9F7AB3011DAB1C06B57
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Windows\System32\drivers\etc\hosts	ASCII text, with CRLF line terminators	B24D295C1F84ECBFB566103374FB91C5	6A750D3F8B45C240637332071D34B403FA1FF55A	4DC7B65075FBC5B5421551F0CB814CAFDC8CACA5957D393C222EE388B6F405F4