top title background image
flash

SWxaTYd36b.exe

Status: finished
Submission Time: 2020-07-31 18:12:44 +02:00
Malicious
Trojan
Spyware
Evader
Vidar

Comments

Tags

  • ArkeiStealer
  • exe

Details

  • Analysis ID:
    255477
  • API (Web) ID:
    406376
  • Analysis Started:
    2020-08-01 00:55:41 +02:00
  • Analysis Finished:
    2020-08-01 01:03:50 +02:00
  • MD5:
    1e20978faf83eef6a9d3f22dc7a2e17e
  • SHA1:
    25c2f7e1e00cfaa7ca77d6e92329378af65cd41f
  • SHA256:
    3d8567fb3b55c792b8ba70e2172726ae80805f1a1c858db29e13a5cd02d8634a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 72
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
78.142.29.223
Bulgaria

Domains

Name IP Detection
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
168.63.67.155
lawrencemaths.com
78.142.29.223
g.msn.com
0.0.0.0

URLs

Name Detection
http://ip-api.com/line/
http://lawrencemaths.com/freebl3.dll
http://lawrencemaths.com/517

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWxaTYd36b.exe_ac299b7bf11636d54ea41073b5dc5d2c6dc0604a_9a838ef8_1844bd40\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWxaTYd36b.exe_ac299b7bf11636d54ea41073b5dc5d2c6dc0604a_9a838ef8_1b644a61\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWxaTYd36b.exe_ac299b7bf11636d54ea41073b5dc5d2c6dc0604a_9a838ef8_1b806e93\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 14 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWxaTYd36b.exe_ac299b7bf11636d54ea41073b5dc5d2c6dc0604a_9a838ef8_0d949025\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB91B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB69A.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7C4.tmp.dmp
Mini DuMP crash report, 14 streams, Sat Aug 1 07:57:07 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BB2.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER88C3.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F8B.tmp.dmp
Mini DuMP crash report, 14 streams, Sat Aug 1 07:56:55 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER656D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER624F.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B78.tmp.dmp
Mini DuMP crash report, 14 streams, Sat Aug 1 07:56:45 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4775.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45DE.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER405F.tmp.dmp
Mini DuMP crash report, 14 streams, Sat Aug 1 07:56:38 2020, 0x1205a4 type
#