Analysis Report PO202100046.exe

Overview

General Information

Sample Name: PO202100046.exe
Analysis ID: 356841
MD5: eafc433b4d4bf4a0edc9b57b6f4af8ec
SHA1: 0ba21c1f4f908e589db07ce4003786e0e7bf62d9
SHA256: 77ee17838c1ea6e3c69ec2989df485386800901ef0caac90e01fadbad225a354
Tags: exeSnakeKeylogger
Infos:

Most interesting Screenshot:

Detection

Snake Keylogger
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Snake Keylogger
Binary contains a suspicious time stamp
Machine Learning detection for sample
May check the online IP address of the machine
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Beds Obfuscator
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram Info": {"Telegram ID": "1556351268", "Telegram Token": "1591373451:AAH6Q2mvjdA9146Wl0khv2-kuh-iTps2zjw"}}
Multi AV Scanner detection for submitted file
Source: PO202100046.exe Virustotal: Detection: 35% Perma Link
Source: PO202100046.exe ReversingLabs: Detection: 31%
Machine Learning detection for sample
Source: PO202100046.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.PO202100046.exe.400000.0.unpack Avira: Label: TR/Spy.Gen

Compliance:

barindex
Uses 32bit PE files
Source: PO202100046.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.6:49723 version: TLS 1.0
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: PO202100046.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Binary contains paths to debug symbols
Source: Binary string: RunPE.pdb source: PO202100046.exe, 00000000.00000002.323840825.0000000002481000.00000004.00000001.sdmp

Networking:

barindex
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: checkip.dyndns.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 131.186.113.70 131.186.113.70
Source: Joe Sandbox View IP Address: 172.67.188.154 172.67.188.154
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.6:49723 version: TLS 1.0
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: unknown DNS traffic detected: queries for: checkip.dyndns.org
Source: PO202100046.exe, 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp String found in binary or memory: http://blog.naver.com/cubemit314Ghttp://projectofsonagi.tistory.com/
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: PO202100046.exe, 00000001.00000002.590242317.0000000002DB1000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: PO202100046.exe, 00000001.00000002.590242317.0000000002DB1000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.org/HB
Source: PO202100046.exe, 00000001.00000002.590354272.0000000002E56000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.org4
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.orgD8
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: PO202100046.exe, 00000001.00000002.589625854.0000000000FD2000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/Om
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: PO202100046.exe, 00000001.00000002.589625854.0000000000FD2000.00000004.00000020.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.c
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://freegeoip.app
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: PO202100046.exe, 00000001.00000002.590242317.0000000002DB1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO202100046.exe, 00000001.00000002.590242317.0000000002DB1000.00000004.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app/xml/
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app/xml/84.17.52.38
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app/xml/84.17.52.38x
Source: PO202100046.exe, 00000001.00000002.590242317.0000000002DB1000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app/xml/LoadCountryNameClipboard
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://freegeoip.app4
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp, PO202100046.exe, 00000001.00000002.590473674.0000000002E94000.00000004.00000001.sdmp String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: PO202100046.exe, 00000001.00000002.590395262.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: PO202100046.exe, 00000000.00000002.323550847.00000000006AB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Detected potential crypto function
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 0_2_00868370 0_2_00868370
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 0_2_00869AB8 0_2_00869AB8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 0_2_00866560 0_2_00866560
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 0_2_00866570 0_2_00866570
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 0_2_00869AA8 0_2_00869AA8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F8130 1_2_012F8130
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012FB230 1_2_012FB230
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F0588 1_2_012F0588
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F7B08 1_2_012F7B08
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F1041 1_2_012F1041
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F1558 1_2_012F1558
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_012F5960 1_2_012F5960
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06370EF8 1_2_06370EF8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063737F0 1_2_063737F0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06373FF0 1_2_06373FF0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063747F0 1_2_063747F0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06374FF0 1_2_06374FF0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637ABF8 1_2_0637ABF8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06371C50 1_2_06371C50
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06370040 1_2_06370040
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637F4D8 1_2_0637F4D8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637E960 1_2_0637E960
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06370E98 1_2_06370E98
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06374793 1_2_06374793
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06373F91 1_2_06373F91
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06374F90 1_2_06374F90
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063737D3 1_2_063737D3
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06370006 1_2_06370006
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637A872 1_2_0637A872
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637F47B 1_2_0637F47B
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06377930 1_2_06377930
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06390040 1_2_06390040
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063940D8 1_2_063940D8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06390828 1_2_06390828
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063948C0 1_2_063948C0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06392970 1_2_06392970
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063917F8 1_2_063917F8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06391010 1_2_06391010
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06393158 1_2_06393158
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06391FE0 1_2_06391FE0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06393940 1_2_06393940
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063907C8 1_2_063907C8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06390007 1_2_06390007
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06394128 1_2_06394128
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06390FB1 1_2_06390FB1
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063948B0 1_2_063948B0
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06392911 1_2_06392911
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06391799 1_2_06391799
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_063930F8 1_2_063930F8
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06391F81 1_2_06391F81
Sample file is different than original file name gathered from version info
Source: PO202100046.exe Binary or memory string: OriginalFilename vs PO202100046.exe
Source: PO202100046.exe, 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCaptIt.dll. vs PO202100046.exe
Source: PO202100046.exe, 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp Binary or memory string: OriginalFilename6D0VQXBZ.exe4 vs PO202100046.exe
Source: PO202100046.exe, 00000000.00000002.323840825.0000000002481000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameRunPE.dll" vs PO202100046.exe
Source: PO202100046.exe Binary or memory string: OriginalFilename vs PO202100046.exe
Source: PO202100046.exe, 00000001.00000002.589473933.0000000000F4A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO202100046.exe
Source: PO202100046.exe, 00000001.00000002.588913424.0000000000CF6000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO202100046.exe
Source: PO202100046.exe, 00000001.00000002.588473253.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilename6D0VQXBZ.exe4 vs PO202100046.exe
Source: PO202100046.exe Binary or memory string: OriginalFilenameScreenCapturer.exe> vs PO202100046.exe
Uses 32bit PE files
Source: PO202100046.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PO202100046.exe, CaptureRectangle.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.PO202100046.exe.40000.0.unpack, CaptureRectangle.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO202100046.exe.40000.0.unpack, CaptureRectangle.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.PO202100046.exe.8b0000.0.unpack, CaptureRectangle.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.PO202100046.exe.8b0000.1.unpack, CaptureRectangle.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal88.troj.spyw.evad.winEXE@3/1@3/2
Source: C:\Users\user\Desktop\PO202100046.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO202100046.exe.log Jump to behavior
Source: PO202100046.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO202100046.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO202100046.exe Virustotal: Detection: 35%
Source: PO202100046.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\PO202100046.exe 'C:\Users\user\Desktop\PO202100046.exe'
Source: unknown Process created: C:\Users\user\Desktop\PO202100046.exe C:\Users\user\Desktop\PO202100046.exe
Source: C:\Users\user\Desktop\PO202100046.exe Process created: C:\Users\user\Desktop\PO202100046.exe C:\Users\user\Desktop\PO202100046.exe Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: PO202100046.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO202100046.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: RunPE.pdb source: PO202100046.exe, 00000000.00000002.323840825.0000000002481000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: initial sample Static PE information: 0xA4622821 [Thu May 24 02:17:05 2057 UTC]
Yara detected Beds Obfuscator
Source: Yara match File source: 00000000.00000002.325194217.0000000004A90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.319958198.0000000004C71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.588473253.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6988, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6952, type: MEMORY
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.4a90000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.4a90000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO202100046.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.raw.unpack, type: UNPACKEDPE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637B601 push es; iretd 1_2_0637B604
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637A76D push es; retf 1_2_0637A870
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637A83B push es; retf 1_2_0637A870
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637BC05 push 8B000003h; iretd 1_2_0637BC0C
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_0637B507 push es; ret 1_2_0637B600
Source: initial sample Static PE information: section name: .text entropy: 7.98391026128
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected Beds Obfuscator
Source: Yara match File source: 00000000.00000002.325194217.0000000004A90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.319958198.0000000004C71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.588473253.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6988, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6952, type: MEMORY
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.4a90000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.4a90000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO202100046.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.raw.unpack, type: UNPACKEDPE
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO202100046.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO202100046.exe TID: 6980 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: PO202100046.exe, 00000001.00000002.589625854.0000000000FD2000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: C:\Users\user\Desktop\PO202100046.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO202100046.exe Code function: 1_2_06371C50 LdrInitializeThunk,KiUserExceptionDispatcher, 1_2_06371C50
Enables debug privileges
Source: C:\Users\user\Desktop\PO202100046.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO202100046.exe Process created: C:\Users\user\Desktop\PO202100046.exe C:\Users\user\Desktop\PO202100046.exe Jump to behavior
Source: PO202100046.exe, 00000001.00000002.589874015.00000000016B0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: PO202100046.exe, 00000001.00000002.589874015.00000000016B0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: PO202100046.exe, 00000001.00000002.589874015.00000000016B0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: PO202100046.exe, 00000001.00000002.589874015.00000000016B0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Users\user\Desktop\PO202100046.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Users\user\Desktop\PO202100046.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000000.00000003.319958198.0000000004C71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.588473253.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6988, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6952, type: MEMORY
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO202100046.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\PO202100046.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\PO202100046.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\PO202100046.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6988, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000000.00000003.319958198.0000000004C71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.323967870.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.588473253.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6988, type: MEMORY
Source: Yara match File source: Process Memory Space: PO202100046.exe PID: 6952, type: MEMORY
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO202100046.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.36a37b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.35ae570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.PO202100046.exe.351bd40.5.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356841 Sample: PO202100046.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 88 21 Found malware configuration 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected Snake Keylogger 2->25 27 4 other signatures 2->27 6 PO202100046.exe 3 2->6         started        process3 file4 13 C:\Users\user\AppData\...\PO202100046.exe.log, ASCII 6->13 dropped 9 PO202100046.exe 15 2 6->9         started        process5 dnsIp6 15 checkip.dyndns.org 9->15 17 checkip.dyndns.com 131.186.113.70, 49719, 49721, 80 DYNDNSUS United States 9->17 19 freegeoip.app 172.67.188.154, 443, 49723 CLOUDFLARENETUS United States 9->19 29 Tries to steal Mail credentials (via file access) 9->29 31 Tries to harvest and steal browser information (history, passwords, etc) 9->31 signatures7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
131.186.113.70
unknown United States
33517 DYNDNSUS false
172.67.188.154
unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
freegeoip.app 172.67.188.154 true
checkip.dyndns.com 131.186.113.70 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown