Source: Tracking No_SINI0035249718.exe |
Virustotal: Detection: 22% |
Perma Link |
Source: Tracking No_SINI0035249718.exe |
ReversingLabs: Detection: 15% |
Source: Tracking No_SINI0035249718.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766058148.000000000078A000.00000004.00000020.sdmp |
Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/> |
|
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Process Stats: CPU usage > 98% |
Source: Tracking No_SINI0035249718.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp |
Binary or memory string: OriginalFilenameGimpy.exe vs Tracking No_SINI0035249718.exe |
Source: Tracking No_SINI0035249718.exe |
Binary or memory string: OriginalFilenameGimpy.exe vs Tracking No_SINI0035249718.exe |
Source: Tracking No_SINI0035249718.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: classification engine |
Classification label: mal76.troj.evad.winEXE@1/0@0/0 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
File created: C:\Users\user\AppData\Local\Temp\~DF9483F3C9D699138F.TMP |
Jump to behavior |
Source: Tracking No_SINI0035249718.exe |
Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Section loaded: C:\Windows\SysWOW64\msvbvm60.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: Tracking No_SINI0035249718.exe |
Virustotal: Detection: 22% |
Source: Tracking No_SINI0035249718.exe |
ReversingLabs: Detection: 15% |
Source: Yara match |
File source: Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032, type: MEMORY |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00401480 push ds; retf |
0_2_004014E3 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0040149C push ds; retf |
0_2_004014E3 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00402DCD push ds; retf |
0_2_00402E76 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00406FD1 push edx; ret |
0_2_00406FFF |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075247F |
0_2_0075247F |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752E61 |
0_2_00752E61 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075125B |
0_2_0075125B |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752842 |
0_2_00752842 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752620 |
0_2_00752620 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075282D |
0_2_0075282D |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752CEF |
0_2_00752CEF |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075629D |
0_2_0075629D |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00754545 |
0_2_00754545 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075273B |
0_2_0075273B |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00751B23 |
0_2_00751B23 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752B1D |
0_2_00752B1D |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075370D |
0_2_0075370D |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752DB5 |
0_2_00752DB5 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_007521BE |
0_2_007521BE |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00752BB9 |
0_2_00752BB9 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
RDTSC instruction interceptor: First address: 0000000000756A61 second address: 0000000000756A61 instructions: |
Source: Tracking No_SINI0035249718.exe |
Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
RDTSC instruction interceptor: First address: 0000000000756A61 second address: 0000000000756A61 instructions: |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
RDTSC instruction interceptor: First address: 000000000075658E second address: 000000000075658E instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F608884DB2Dh 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ch, bh 0x0000001f cmp ebx, edx 0x00000021 add edi, edx 0x00000023 cmp cx, 703Bh 0x00000028 dec dword ptr [ebp+000000F8h] 0x0000002e jmp 00007F608884DB46h 0x00000030 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000037 jne 00007F608884DAD5h 0x00000039 cmp ebx, 7B9ECC22h 0x0000003f cmp eax, edx 0x00000041 call 00007F608884DBC4h 0x00000046 call 00007F608884DB3Dh 0x0000004b lfence 0x0000004e mov edx, dword ptr [7FFE0014h] 0x00000054 lfence 0x00000057 ret 0x00000058 mov esi, edx 0x0000005a pushad 0x0000005b rdtsc |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075247F rdtsc |
0_2_0075247F |
Source: Tracking No_SINI0035249718.exe |
Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075247F rdtsc |
0_2_0075247F |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_0075247F mov eax, dword ptr fs:[00000030h] |
0_2_0075247F |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00755C4B mov eax, dword ptr fs:[00000030h] |
0_2_00755C4B |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_007534AB mov eax, dword ptr fs:[00000030h] |
0_2_007534AB |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00751B23 mov eax, dword ptr fs:[00000030h] |
0_2_00751B23 |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_007521FD mov eax, dword ptr fs:[00000030h] |
0_2_007521FD |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_007521BE mov eax, dword ptr fs:[00000030h] |
0_2_007521BE |
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe |
Code function: 0_2_00756188 mov eax, dword ptr fs:[00000030h] |
0_2_00756188 |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp |
Binary or memory string: Program Manager |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp |
Binary or memory string: Shell_TrayWnd |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp |
Binary or memory string: Progman |
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp |
Binary or memory string: Progmanlock |