Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

citadel_0.0.1.1.exe

Status: finished
Submission Time: 2020-07-19 20:35:38 +02:00
Malicious
Phishing
Spyware
Evader

Comments

Tags

  • citadel
  • ZeuS

Details

  • Analysis ID:
    247148
  • API (Web) ID:
    389943
  • Analysis Started:
    2020-07-19 22:24:53 +02:00
  • Analysis Finished:
    2020-07-19 22:41:14 +02:00
  • MD5:
    fb340f7a5dbb81b63198d0637b94fa13
  • SHA1:
    c73fec0e884dd8c0605257adcec1ab1153175455
  • SHA256:
    76494ca680d605eca75201ecf6c87bf1c6070c640e95bf3acfd633ac529a8487
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 58/71
Open Full Report
malicious
Score: 18/42
malicious
Score: 25/31
malicious

IPs

IP Country Detection
0.0.1.1
 unknown
104.108.49.57
 United States
104.108.35.215
 United States

URLs

Name Detection
https://www.google.ch/xjs/_/js/k=xjs.s.en_GB.exaHKifUbd4.O/ck=xjs.s.VN7hb22Vkco.L.I11.O/m=Fkg7bd
http://www.tiro.com
https://www.google.ch/images/nav_logo299.png
Click to see the 97 hidden entries
https://xsts.auth.xboxlive.com
http://www.founder.com.cn/cn/bThe
http://coffeerem.com/arpege/wp-includes/panel/file.phpknd
https://login.windows.net
https://xsts.auth.xboxlive.com/
https://policies.yahoo.com/w3c/p3p.xml
http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl0
https://www.google.ch/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png
http://crl.pki.goog/gsr2/gsr2.crl0?
https://aefd.nelreports.net/api/report?cat=bingrms
https://www.msn.com/spartan/en-us/secure/silentpassport?secure=true&lc=1033
https://www.msn.com/content/images/icons/Favicon_EdgeStart.ico
https://www.google.ch/xjs/_/js/k=xjs.s.en_GB.exaHKifUbd4.O/ck=xjs.s.
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut
https://pr-bh.ybp.yahoo.com/sync/msn/2D22DE20AE066B032C5ED0B2AF0F6A94
https://logincdn.msauth.net/16.000/js/MeControl_tfp5xc9B9RRsZ_q18BJrBA2.js
https://cdn.onenote.net/
http://cofoffeerem.com/arpege/wp-includes/panel/file.php05
https://px.ads.linkedin.com/collect/?fmt=gif&pid=7850&liSync=true
https://login.windows.net/
https://srtb.msn.com/auction?a=de-ch&b=687d3f87ff2e49babadba9e49aac8d3f&c=MSN&d=http%3A%2F%2Fwww.msn
http://www.carterandcone.coml
http://www.%s.comPA
https://api.w.org/
https://cvision.media.net/new/300x300/2/59/25/211/dbde3f3c-eae8-448a-9ce8-5bce3ce848b1.jpg?v=9
http://blob.weather.m
http://127.0.0.1:%u//%s/%s%sX-Type:
https://sectigo.com/CPS0
http://www.apache.org/licenses/LICENSE-2.0
http://www.sakkal.com
http://127.0.0.1:%u/
https://cdn.onenote.net/livetile/?Language=en-USLL
https://coffeerem.com/wp-json/
http://www.sandoll.co.kr
http://www.fonts.com
http://gmpg.org/xfn/11
https://cvision.media.net/new/300x300/3/108/131/132/67242227-7e6f-4527-83ab-b36ef6ebcdaa.jpg?v=9
https://www.google.ch/favicon.ico
https://mem.gfx.ms/scripts/me/MeControl/10.20027.3/en-US/meBoot.min.js
https://s.yimg.com/lo/api/res/1.2/FN4h_a.kTjdeFYsRtNEUxg--~A/Zmk9ZmlsbDt3PTIwODtoPTI0MjthcHBpZD1nZW1
http://fontfabrik.com
http://www.typography.netD
https://www.google.ch/images/searchbox/desktop_searchbox_sprites302_hr.png
https://s.yimg.com/lo/api/res/1.2/HTh4MviMESQCU1YsoWf5Ew--~A/Zmk9ZmlsbDt3PTIwODtoPTI0MjthcHBpZD1nZW1
https://mem.gfx.ms/scripts/me/MeControl/10.20027.3/en-US/meCore.min.js
http://www.goodfont.co.kr
https://cdn.adnxs.com/v/s/184/trk.js
http://www.founder.com.cn/cn/cThe
http://crl.pki.goog/GTS1O1.crl0
https://img.s-msn.com/tenant/amp/entityid/AAbzMB2.img
https://87102a4e47b39a9075c891cdc256e1e9.clo.footprintdns.com/apc/trans.gif?8c23236cfa866020f02514c9
http://www.zhongyicts.com.cn
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/Wide/Image2.png
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/MediumAndLarge/Image2.png
http://www.msn.com/?ocid=iehp
http://crt.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crt0#
https://img-s-msn-com.ak
https://maps.windows.com/windows-app-web-link
http://coffeerem.com/arpege/wp-inclu
https://contextual.media.net/mediamain.html?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3D%3D&
http://coffeerem.com/arpege/wp-includes/panel/file.phpp
http://www.sajatypeworks.com
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_350%2Cw_624%2Cc_fill%2Cg_faces:aut
http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x.php
https://contextual.media.net/nrrV79893.js
https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meCore.min.js
https://s.yimg.com/lo/api/res/1.2/mpnNnPAItj5pNCsM3mwM7A--~A/Zmk9ZmlsbDt3PTIwODtoPTI0MjthcHBpZD1nZW1
http://www.msn.com
https://px.ads.linkedin.com/collect/?fmt=gif&pid=7850
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/Small/Image2.png
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801
http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x.phpfileipfilewww.www.
http://pki.goog/gsr2/GTS1O1.crt0
https://site-cdn.onenote.net/161251631559_Images/LiveTileImages/Wide/Image2.png
https://%s.xboxlive.com
http://www.google.ch/
https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
https://pki.goog/repository/0
http://ocsp.pki.goog/gsr202
http://coffeerem.com/arpege/wp-includes/panel/file.phpZ
http://coffeerem.com/arpege/wp-includes/panel/file.php
https://img.s-msn.com/tenant/amp/entityid/AAbzMB2
http://coffeerem.com/arpege/wp-includes/panel/file.phpX
http://coffeerem.com/
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=11
https://logincdn.msauth.net/16.000/js/MeControl_US1oxnIoNcCp1NX7xVSBjw2.js
https://www.google.ch/xjs/_/js/k=xjs.s.en_GB.exaHKifUbd4.O/ck=xjs.s.VN7hb22Vkco.L.I11.O/am=AAAAgCUAs
https://img.s-msn.com/tenant/amp/entityid/AAbzMB2.imgs
http://ocsp.pki.goog/gts1o10
http://ocsp.sectigo.com09
https://www.bizographics.com/collect/?fmt=gif&pid=7850
https://acdn.adnxs.com/ast/ast.js
http://coffeerem.com/arpege/wp-includes/panel/file.phpg
http://coffeerem.com/arpege/wp-includes/panel/file.phprq
http://schemas.microsoft
http://coffeerem.com/ar

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\citadel_0.0.1.1.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmpb15807ab.bat
 DOS batch file, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Roaming\Woipuvizomu\onutkoobdi.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 6 hidden entries
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\onutkoobdi.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp41A2.tmp
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\tmp4240.tmp
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\tmp5E43.tmp
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\tmp6170.tmp
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Roaming\Ucaretidudo\byzizuim.iws
 data
 #