Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Trojan.MulDrop16.9965.2278.18780

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.MulDrop16.9965.2278.18780 (renamed file extension from 18780 to exe)
Analysis ID:	345042
MD5:	e750511892ab532fb2147f4537dabcfd
SHA1:	d78aa528d38fa57bd3a5bf591cbd4437ebcdf377
SHA256:	4328e4ac330339d884b95d99128404d4f8b5d6b695a9f583ff4c3f3a61ac4ff8

Detection

AgentTesla

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM_3

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Startup

System is w10x64

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 5660 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe' MD5: E750511892AB532FB2147F4537DABCFD)

schtasks.exe (PID: 4864 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp' MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 4700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 5456 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe MD5: E750511892AB532FB2147F4537DABCFD)

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 852 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe MD5: E750511892AB532FB2147F4537DABCFD)

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 5948 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe MD5: E750511892AB532FB2147F4537DABCFD)

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 5796 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe MD5: E750511892AB532FB2147F4537DABCFD)

SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe (PID: 1368 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe MD5: E750511892AB532FB2147F4537DABCFD)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.225631461.0000000002DD1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe' , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, ParentProcessId: 5660, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp', ProcessId: 4864

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XdwuEt.exe	Virustotal: Detection: 35%			Perma Link
Source: C:\Users\user\AppData\Roaming\XdwuEt.exe	ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Virustotal: Detection: 35%			Perma Link
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	ReversingLabs: Detection: 13%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\XdwuEt.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Joe Sandbox ML: detected

Compliance:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225631461.0000000002DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip

System Summary:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Code function: 3_2_00909369	3_2_00909369
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Code function: 4_2_00179369	4_2_00179369
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Code function: 5_2_00E99369	5_2_00E99369
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Code function: 6_2_006E9369	6_2_006E9369
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Code function: 7_2_00F39369	7_2_00F39369

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XdwuEt.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal96.troj.evad.winEXE@14/4@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File created: C:\Users\user\AppData\Roaming\XdwuEt.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Mutant created: \Sessions\1\BaseNamedObjects\bekswvIDa
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4700:120:WilError_01

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp

Jump to behavior

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Virustotal: Detection: 35%
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe'
Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Source: initial sample	Static PE information: section name: .text entropy: 7.80365257713
Source: initial sample	Static PE information: section name: .text entropy: 7.80365257713

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File created: C:\Users\user\AppData\Roaming\XdwuEt.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.225631461.0000000002DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Code function: 3_2_0090471C sldt word ptr [edx]

3_2_0090471C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe TID: 5936	Thread sleep time: -53886s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe TID: 6136	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Jump to behavior

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection11	Masquerading1	OS Credential Dumping	Security Software Discovery211	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Virtualization/Sandbox Evasion4	LSASS Memory	Virtualization/Sandbox Evasion4	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection11	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing2	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	35%	Virustotal		Browse
SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	13%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XdwuEt.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XdwuEt.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Roaming\XdwuEt.exe	13%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225631461.0000000002DD1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	345042
Start date:	27.01.2021
Start time:	16:14:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.MulDrop16.9965.2278.18780 (renamed file extension from 18780 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@14/4@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.5% (good quality ratio 2.5%) Quality average: 31% Quality standard deviation: 32.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated
Warnings:	Show All Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:15:31	API Interceptor	2x Sleep call for process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe.log Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1742
Entropy (8bit):	5.381353871108486
Encrypted:	false
SSDEEP:	48:MxHKEYHKGD8Ao6+vxpNl1qHGiD0HKeGitHTG1hAHKKPJAmHKoA9:iqEYqGgAo9ZPlwmI0qertzG1eqKPJ/qT
MD5:	978918F6120A43D1FA5899938A5A542F
SHA1:	6567A2E687B40BFD3A46246F51F4C89D93D89455
SHA-256:	F814F290A540B3FD755D05F3434317D7B26F2C33D2087F9E63233CD88AB510FC
SHA-512:	1DF2AF5A3F8212BF591AAA366FE96F167F3E6D43746E07B7CD44F1B2F06C63B1D290412891AD0B4D0A82D1DFD6EB2EB7D70981C35941F370DC97729E9205DD53
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_6

C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	5.184744549823039
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBLQrtn:cbh47TlNQ//rydbz9I3YODOLNdq3NQp
MD5:	90BBB757FD516A98CE985F615199C9C5
SHA1:	D17490C1D27995F6B68F137D14E6732A3E156C2C
SHA-256:	C90368DA6B08D81AF46467FCD1F37550E9A11393DFDFBE0FBE372C61416D1708
SHA-512:	EF79D2570DF43FF1BB12E049D49286BB3011BE58203E48FEDF283AB31DC0E5F358B86806D1E2B8A73436A313C26720C5EBEE4AA0E552C81E357D6D657287450B
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\XdwuEt.exe Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	541184
Entropy (8bit):	7.789762421792232
Encrypted:	false
SSDEEP:	12288:jgDW4PmoO4lv8zw7n9AXJBkwVHI3eC9Z9rzWmvRM:L4uoO4VnsJRHc/zJ
MD5:	E750511892AB532FB2147F4537DABCFD
SHA1:	D78AA528D38FA57BD3A5BF591CBD4437EBCDF377
SHA-256:	4328E4AC330339D884B95D99128404D4F8B5D6B695A9F583FF4C3F3A61AC4FF8
SHA-512:	F0C1AF9E1B8175EA91337702FFA8140DD0C901C8AC570A1DEF1299F2493EFC6FD66F36E19C8AE6B1B5C2B0F174A44A8754761A30EB2E652F3FC2E8D90A939BD5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 35%, Browse Antivirus: ReversingLabs, Detection: 13%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.........."...P..6...........U... ...`....@.. ....................................@.................................tU..O....`..`............................................................................ ............... ..H............text....5... ...6.................. ..`.rsrc...`....`.......8..............@..@.reloc...............@..............@..B.................U......H.......\|...............,...H............................................0............(....(..........(.....o..........................( ......(!......("......(#......($....N..(....o....(%....&..(&.....s'........s(........s)........s........s+............0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+...0...........~....o0....+..&..(1.......0..<........~.....(2.....,!r...p.....(3...o4...s5............~.....

C:\Users\user\AppData\Roaming\XdwuEt.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.789762421792232
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
File size:	541184
MD5:	e750511892ab532fb2147f4537dabcfd
SHA1:	d78aa528d38fa57bd3a5bf591cbd4437ebcdf377
SHA256:	4328e4ac330339d884b95d99128404d4f8b5d6b695a9f583ff4c3f3a61ac4ff8
SHA512:	f0c1af9e1b8175ea91337702ffa8140dd0c901c8ac570a1def1299f2493efc6fd66f36e19c8ae6b1b5c2b0f174a44a8754761a30eb2e652f3fc2e8d90a939bd5
SSDEEP:	12288:jgDW4PmoO4lv8zw7n9AXJBkwVHI3eC9Z9rzWmvRM:L4uoO4VnsJRHc/zJ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.........."...P..6...........U... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4855c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x601113D8 [Wed Jan 27 07:18:48 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85574	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x86000	0x660	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x835cc	0x83600	False	0.878449096099	data	7.80365257713	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x86000	0x660	0x800	False	0.3466796875	data	3.54395993413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x86090	0x3d0	data
RT_MANIFEST	0x86470	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Steffen Henjes
Assembly Version	0.2.0.0
InternalName	LocalActivator.exe
FileVersion	0.2.0.0
CompanyName	www.steffen-blogging.de
LegalTrademarks
Comments
ProductName	Dummy File Creator - powered by steffen-blogging.de
ProductVersion	0.2.0.0
FileDescription	DFC - Dummy File Creator
OriginalFilename	LocalActivator.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660 Parent PID: 5532

General

Start time:	16:15:30
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe'
Imagebase:	0x980000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.225631461.0000000002DD1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.225667409.0000000002E28000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4864 Parent PID: 5660

General

Start time:	16:15:32
Start date:	27/01/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XdwuEt' /XML 'C:\Users\user\AppData\Local\Temp\tmpCBF8.tmp'
Imagebase:	0x7ff634190000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4700 Parent PID: 4864

General

Start time:	16:15:33
Start date:	27/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5456 Parent PID: 5660

General

Start time:	16:15:33
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Imagebase:	0x900000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 852 Parent PID: 5660

General

Start time:	16:15:34
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Imagebase:	0x170000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5948 Parent PID: 5660

General

Start time:	16:15:34
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Imagebase:	0xe90000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5796 Parent PID: 5660

General

Start time:	16:15:35
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Imagebase:	0x6e0000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 1368 Parent PID: 5660

General

Start time:	16:15:35
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Imagebase:	0xf30000
File size:	541184 bytes
MD5 hash:	E750511892AB532FB2147F4537DABCFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660 Parent PID: 5532 SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exeCOMMON

Executed Functions

Function 00007FFAEE0B1C9A, Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

%]_^, xrefs: 00007FFAEE0B1CB1

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID: %]_^
API String ID: 0-1664876699
Opcode ID: e83349602911db4dba97fac454dc00596e36940e0ae925eeb9010117d759ad09
Instruction ID: bfb5c3df2a885f80ca8a48b36e096ade891db2b7a6680cd496ed2a1688be37dc
Opcode Fuzzy Hash: e83349602911db4dba97fac454dc00596e36940e0ae925eeb9010117d759ad09
Instruction Fuzzy Hash: 1231CB72E5D55E4AEB41FB78E9912FDBBA1FF4A320F040076E04CD6197EE7438498285

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B0A0B, Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

k?]_^, xrefs: 00007FFAEE0B0A0B

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID: k?]_^
API String ID: 0-3699767654
Opcode ID: 74f545da815691454740f391c69a94abcbd1fa06e9cde1e67c142cdc45da54a0
Instruction ID: 38379ed7e8ca879100075bc16af50fecb5d9b405186a8632fd1ca3eba2e114c3
Opcode Fuzzy Hash: 74f545da815691454740f391c69a94abcbd1fa06e9cde1e67c142cdc45da54a0
Instruction Fuzzy Hash: F8E0C231A4881E8FCF80EB9CD480EEDB7B0FB59310F000162E10DE3155EA34A8408B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B0A41, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab95f7a6ddc4acb21ba4add5819d18f0d34c6d28c2c1c2f101054f2fa11441a
Instruction ID: a742ef84ec21510b33398c5d2577ab2986d98e3f478bb4f386f4c514d3cbe55c
Opcode Fuzzy Hash: 9ab95f7a6ddc4acb21ba4add5819d18f0d34c6d28c2c1c2f101054f2fa11441a
Instruction Fuzzy Hash: CAB13B70D08A5D8FDBA4EF68C8947E8BBB1FF59300F1000BAD00DE7296CA756981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B260A, Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d813e7a2ad4c905ef1bee6251b162b0a1ebb53289de864a06cd48119469469
Instruction ID: d1ead2743b8ef2f264d65559f6aa97bf8aaaee533ab7b9633b88eed1fc018090
Opcode Fuzzy Hash: d9d813e7a2ad4c905ef1bee6251b162b0a1ebb53289de864a06cd48119469469
Instruction Fuzzy Hash: 2CA14875D4850A8FEB48EFA9C484ABDB7B1FF59300F118579D00DA73AADA34A841CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B1FAD, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ec094ce105a2dfe3ef94e3e3c8ee6cdd6a53122f8056aa6a1e9ff3ab0df7c4
Instruction ID: 7cbe71e63e53265ff892243da3a845d0c284af44db1e88b52cceac8d81528d5e
Opcode Fuzzy Hash: 91ec094ce105a2dfe3ef94e3e3c8ee6cdd6a53122f8056aa6a1e9ff3ab0df7c4
Instruction Fuzzy Hash: 1B810C70A18A1D8FDB94EF68C899BACB7F1FF59300F1141BAD00DE3291DA75A981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B2338, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0ca29a6cd8638493d18fcc90ed18b7acf3be4d4ae7b9e222d95307faa3778c
Instruction ID: ba733b7b31fc9b99e2c3d9ca1644a88f7dd767c9752ad876d9c5c660e2478523
Opcode Fuzzy Hash: 0f0ca29a6cd8638493d18fcc90ed18b7acf3be4d4ae7b9e222d95307faa3778c
Instruction Fuzzy Hash: 4C715B71D0860A8FDB58DF69D4817BEB7B2FF99300F11817AD00DA7799DB7468818B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B1705, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e70aca003496ad03e11b9a6dea2bb66adff7b2ecf28aec07e32897d6e9e3544
Instruction ID: fad44cc0f9410c71e5ca97ce8bacb8bf0523e9f91f023b135e3dba3076ef27b8
Opcode Fuzzy Hash: 7e70aca003496ad03e11b9a6dea2bb66adff7b2ecf28aec07e32897d6e9e3544
Instruction Fuzzy Hash: 3261FB71A08A1D8FDF94EF68C899BACB7F1FF59300F5440AAD00DE7295DA75A881CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B0FD9, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6608d44f835816360588afc4f10b800e760b18cada9876e5e71d5cf919ef516d
Instruction ID: df60ad72782760dceae7aec30fcc9b0d71db6b1e791addc286685b77318f5b21
Opcode Fuzzy Hash: 6608d44f835816360588afc4f10b800e760b18cada9876e5e71d5cf919ef516d
Instruction Fuzzy Hash: E0411571D4DA8E8FDB94EF68D8866ED7BB0FF56310F0541B6E00CD319ACD6869428742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B1459, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745ee456a93260205550175bb01cce6f60168d5c9e7a972399d261219b1e0105
Instruction ID: 98f43d663064b39ceb367776cbdca673e0d891cb0923e3c7dfde516360a8a68e
Opcode Fuzzy Hash: 745ee456a93260205550175bb01cce6f60168d5c9e7a972399d261219b1e0105
Instruction Fuzzy Hash: B85112B1D0821A8FDB69EF64C891AEDB3B2FF59300F1041B9D00EA7296CA346985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B245A, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d271926de1dbc1ee461278c6d66165f200d013dcd24edceeb1510f49f11b65
Instruction ID: 17777a541fb37bfb027cd6f737365c85b1b175f292ccc10f6b5d81cb94de9982
Opcode Fuzzy Hash: a4d271926de1dbc1ee461278c6d66165f200d013dcd24edceeb1510f49f11b65
Instruction Fuzzy Hash: 6D5125B0E086198FEB58DF58D881BAEB7B1FF89310F1081B9D00DA7785DB346981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B147F, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6b2061fbe1fb95061a70f508633fdf4081680687b59eaab55ca7a3d30412de
Instruction ID: 32ea4fca0bb15049e72a4bb01785cc2de359d52391ae5fe28de6348a8f74eba9
Opcode Fuzzy Hash: 3f6b2061fbe1fb95061a70f508633fdf4081680687b59eaab55ca7a3d30412de
Instruction Fuzzy Hash: DB41367590812ACEDF59EF14C890AE9B3B1FF59300F1045F9D04EA7296CA74AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B222D, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143bf56acedce8fd1297e620b94f3b6497eeaacdc01433396331bfe3022d69a0
Instruction ID: 4acfc2858f911f784c4cbc7d651dc5212e31c31cf60922d2b018343925ea17ff
Opcode Fuzzy Hash: 143bf56acedce8fd1297e620b94f3b6497eeaacdc01433396331bfe3022d69a0
Instruction Fuzzy Hash: 89317C7094894D8FDF81EFA8D899AEDBBF1FF6A300F05406AE00CE3256DA74A8418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B14CC, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98059e2b9a875bc1b09ba949b180b124f7b8efb7d43841b8b73274e122eaa828
Instruction ID: f99eb641d3b67367b9847302322d4eabb871c7d82f99a185190446b738450bc2
Opcode Fuzzy Hash: 98059e2b9a875bc1b09ba949b180b124f7b8efb7d43841b8b73274e122eaa828
Instruction Fuzzy Hash: DF4102B1D085298BDF59EF24C890AE9B3B2FF19300F1041F9D04EA7296DA346E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B11F1, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290145d9f5a5c5f29f91a376f243dded994b9737289c2fbe14c3f99ec66bc613
Instruction ID: 44a27e53f6d4f9873e5fa711d24ed9eb9fdb1163a86f4b6d0d41a71fee807369
Opcode Fuzzy Hash: 290145d9f5a5c5f29f91a376f243dded994b9737289c2fbe14c3f99ec66bc613
Instruction Fuzzy Hash: E8315B71D48A1C8FDB44EF98D895BEDBBF1FF69301F454166E009E3291CA78A841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B03F7, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5113622c4a6c1c06c5f3358721b162cc67e29bb56baabb42dc4f3581377bcb41
Instruction ID: fa286ffa892fa268dad68bda8caf74cb1520265943d86c215bbfd26485681f5f
Opcode Fuzzy Hash: 5113622c4a6c1c06c5f3358721b162cc67e29bb56baabb42dc4f3581377bcb41
Instruction Fuzzy Hash: 9A31D2B2E4D25A8BE710FF68A8951F977A0EF47321F0504B7E08C8B096EF356D498681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B06FD, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba5ad8d24cc0a13fc440d238352ab321c390144392cdeb300c69787c6969bb9
Instruction ID: a5fbb2c890b6a0864748de12fdf97c80f684ada905e8940b0099f4c0da707eb0
Opcode Fuzzy Hash: aba5ad8d24cc0a13fc440d238352ab321c390144392cdeb300c69787c6969bb9
Instruction Fuzzy Hash: 4B315771A08A4D8FDB94EF68D494BADB7E1FF99310F0400BAE00DD3295DA75A845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B0710, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d8337e932a26d582f0da7f602dfa3eeab086a8d919722c166a3072a31675cb
Instruction ID: 80c44bfedf88f1b54ad2d69d89224055a5ad7e046610eb4f10392448dbee83d3
Opcode Fuzzy Hash: 58d8337e932a26d582f0da7f602dfa3eeab086a8d919722c166a3072a31675cb
Instruction Fuzzy Hash: 82310371A18A1D8FDB98EF68D494BADB7E1FF99310F00047AE00EE3295DA75A841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B42F0, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348acee337449f74ae317aac94eed7ca4e7ee512f82c25ae99756f699bc0a38b
Instruction ID: f72edcdf2aa2c6947372ecd0531cd805723348460fb5e6bde1fcca335dbea4a4
Opcode Fuzzy Hash: 348acee337449f74ae317aac94eed7ca4e7ee512f82c25ae99756f699bc0a38b
Instruction Fuzzy Hash: E1414870E0861A8FEB44EB59C4907ADB7B1FF49300F5145B9D00EEB286DFB86945CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B4832, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9eb154ef8f4028843f350e6d21439d69918980ea825b09ff6138b8eb34767f
Instruction ID: f2355fb77a000d625a01c9ac0c86b2a440c1826d516f4b87145d3b4e29d616dd
Opcode Fuzzy Hash: df9eb154ef8f4028843f350e6d21439d69918980ea825b09ff6138b8eb34767f
Instruction Fuzzy Hash: 2F310670A589198FEB58EB68C8957ADB7B1FF49300F5141B9C00EE7296DE786A808B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B1F01, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d39e2fcdff8414e4ccfa69dbf5b90f4f5da1ef46e92d34eb69e1faf9a300072
Instruction ID: 55bc9efbe849c66c142a2212b0288887b40ddef917630888fedb430de2ecdd70
Opcode Fuzzy Hash: 1d39e2fcdff8414e4ccfa69dbf5b90f4f5da1ef46e92d34eb69e1faf9a300072
Instruction Fuzzy Hash: 0D21DE3085864E8FDB45FF28C488AE9BBA1FF4A300F5189B6E00DCB196DA74A851C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B1149, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a67c2f0da211f06f32a613028fd22e30831a827f99bcb444757fca68a4a93b
Instruction ID: 844fb8bb278fbabdef1f21e9260ff7bcbc2568fa2105f8917a089c50d03fbc4f
Opcode Fuzzy Hash: d8a67c2f0da211f06f32a613028fd22e30831a827f99bcb444757fca68a4a93b
Instruction Fuzzy Hash: 2021C071948A4E8FDF80EFA8C888AED7BF1FF5A310F004465E00CE3296CA74A945CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B07E9, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4066482afc3f137f82a73f8c79de7ca4db200af121f0bacec75ad75a7ddca1
Instruction ID: 38dc5cfafb108eb05a4fab152b4c1fa2155b4f776917e59923d2b55f24f73853
Opcode Fuzzy Hash: 9f4066482afc3f137f82a73f8c79de7ca4db200af121f0bacec75ad75a7ddca1
Instruction Fuzzy Hash: 6C01807898868E8FE714EF2498812FA7751EF89304F4A4835E41D8318ACEBDAA158781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B163D, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227c313d6fb1b4d66a8a1d691fcd5f01e60ab0273fd329f08706983c3ffb1f0b
Instruction ID: c8b889cdd473a2d6755ad981d7411147997ce0626c1f4f4ac96ecf69f89f308f
Opcode Fuzzy Hash: 227c313d6fb1b4d66a8a1d691fcd5f01e60ab0273fd329f08706983c3ffb1f0b
Instruction Fuzzy Hash: E5018F7084C68E8FDB86EF6488986E97FE1FF5A300F4540A6E848C2197DAB45955C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B8EB1, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e7073a9ac19f401892e583578bd2ba5176bf66af77c4011e8622c5c93cda31
Instruction ID: 7b79b1adfd7f34d420f96990597e177f5b36627d2b945813db934c28a64f1909
Opcode Fuzzy Hash: e8e7073a9ac19f401892e583578bd2ba5176bf66af77c4011e8622c5c93cda31
Instruction Fuzzy Hash: 8AE04F7095891E8FDB69DB0488A07E873B0FF09301F1140F9810DE3155CA742A808B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0B775D, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be150252665b15e35d6b99c94890ad4e3d4a65884eebe5d1b06f854d93b2867f
Instruction ID: 0a8fe2870002184f2ae3cd9993c69bef7166122fd2ed71ed56f8e898ccd9fb7f
Opcode Fuzzy Hash: be150252665b15e35d6b99c94890ad4e3d4a65884eebe5d1b06f854d93b2867f
Instruction Fuzzy Hash: 66E0B6B0E9892E9EDBA8DB088880BA976B0FB16315F5041F9814DD3240DA746A80CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0BA21F, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4eb0b759228c07c382325bbc31771a05f047c0787b7477bccb28c83a57778d
Instruction ID: 3a23bd0b4bea107d1af5d43e4aef6fc1eb8de29fe80e57e08006b2559081813a
Opcode Fuzzy Hash: ba4eb0b759228c07c382325bbc31771a05f047c0787b7477bccb28c83a57778d
Instruction Fuzzy Hash: 3BD0C7B0DA455F9EDB94DF1488807697670FB06325F5042F9864DD3190DE745DC0CF06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAEE0BA626, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.229748872.00007FFAEE0B0000.00000040.00000001.sdmp, Offset: 00007FFAEE0B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9d006973a8b5bfde377d709e77b4c53871ea4f74c5879df0b42c2fb444094e
Instruction ID: 3594c4f6292c89ee2afbfdf124911eaab378ef09a81ee740e39fe6534db08ce4
Opcode Fuzzy Hash: aa9d006973a8b5bfde377d709e77b4c53871ea4f74c5879df0b42c2fb444094e
Instruction Fuzzy Hash: CDC04C32D9801749D554A71584419E962247F1A300FA28171DA1C571BB5DA83A058651

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5456 Parent PID: 5660 SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exeCOMMON

Executed Functions

Non-executed Functions

Function 00909369, Relevance: 1.8, Instructions: 1817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.221329860.0000000000902000.00000002.00020000.sdmp, Offset: 00900000, based on PE: true

Associated: 00000003.00000002.221325806.0000000000900000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bdb62210079aa16b8a48e58afaa9be71481ffd0df0959d6a7506e0c9ff36ba
Instruction ID: 8aa1f0c119076273f497450ab217dbb9bbc82dc005de49b1d73eb6cc62ad4658
Opcode Fuzzy Hash: 89bdb62210079aa16b8a48e58afaa9be71481ffd0df0959d6a7506e0c9ff36ba
Instruction Fuzzy Hash: 8BE26B2104E7C25FD7438B7888756E27FB5AE5732470E48DBC4C08F4A3E219696ADB72

Uniqueness

Uniqueness Score: -1.00%

Function 0090471C, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.221329860.0000000000902000.00000002.00020000.sdmp, Offset: 00900000, based on PE: true

Associated: 00000003.00000002.221325806.0000000000900000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e98126764dc75492317816b0e0412c6389223381b99e132c440bee266d7d6d2
Instruction ID: db7e5cfbf62dc1d7e8332e6b11db389318702bd7d94ced9fc50d5617dd886c79
Opcode Fuzzy Hash: 2e98126764dc75492317816b0e0412c6389223381b99e132c440bee266d7d6d2
Instruction Fuzzy Hash: 8DE0460A00FAC19EE71327B03B36ADA7F35AE93310B0984C3D0802A2A3A8000754D272

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000000.213372307.0000000000982000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225583426.0000000002C00000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSoapName.dll2 vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.229284290.000000001B760000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225597685.0000000002C60000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225597685.0000000002C60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225528629.0000000002B30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePositiveSign.dll< vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.226077491.0000000012DE1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameblDfexytmIsjktOhVhedavVGNLfjoGevXVht.exe4 vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000000.00000002.225398705.0000000000F4B000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000003.00000000.221181067.0000000000902000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000004.00000002.222227234.0000000000172000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000005.00000000.223073350.0000000000E92000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000006.00000000.223922655.00000000006E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe, 00000007.00000002.224874903.0000000000F32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe
Source: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe	Binary or memory string: OriginalFilenameLocalActivator.exe vs SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Trojan.MulDrop16.9965.2278.18780

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.MulDrop16.9965.2278.exe PID: 5660 Parent PID: 5532

General

Analysis Process: schtasks.exe PID: 4864 Parent PID: 5660

General