Play interactive tour

Edit tour

Windows Analysis Report E9NhUneknw

Overview

General Information

Sample Name:	E9NhUneknw (renamed file extension from none to exe)
Analysis ID:	466786
MD5:	f3d648c4f3a0f9cfbead90e546efe8f6
SHA1:	cba4d6e13b5f1e766914ef65ff50c19bb295c17f
SHA256:	cd80318bc4c724934435231e72cbf7cbf5942df8b36e480603237e2ed08d4a93
Tags:	32exe
Infos:
Most interesting Screenshot:

Detection

44Caliber Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected 44Caliber Stealer

Antivirus / Scanner detection for submitted sample

Tries to steal Crypto Currency Wallets

Contains functionality to capture screen (.Net source)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

E9NhUneknw.exe (PID: 6904 cmdline: 'C:\Users\user\Desktop\E9NhUneknw.exe' MD5: F3D648C4F3A0F9CFBEAD90E546EFE8F6)

cleanup

Malware Configuration

Threatname: 44Caliber Stealer

{"Discord Webhook": "https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1kXoCYdJjwftfW7KLWuy0\u0001logger"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
E9NhUneknw.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
E9NhUneknw.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: E9NhUneknw.exe PID: 6904	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
0.0.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
0.2.E9NhUneknw.exe.4f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.E9NhUneknw.exe.4f0000.0.unpack

Malware Configuration Extractor: 44Caliber Stealer {"Discord Webhook": "https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1kXoCYdJjwftfW7KLWuy0\u0001logger"}

Multi AV Scanner detection for submitted file

Show sources

Source: E9NhUneknw.exe

Virustotal: Detection: 67%

Perma Link

Antivirus / Scanner detection for submitted sample

Show sources

Source: E9NhUneknw.exe

Avira: detected

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD557A CryptUnprotectData,		0_2_00007FFA35FD557A
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FDC4B9 CryptUnprotectData,		0_2_00007FFA35FDC4B9

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: E9NhUneknw.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" source: E9NhUneknw.exe, 00000000.00000003.673158824.0000000000A24000.00000004.00000001.sdmp
Source:	Binary string: .PDBimeS source: E9NhUneknw.exe, 00000000.00000002.683565920.000000000099B000.00000004.00000020.sdmp
Source:	Binary string: E:\44CALIBER-main\44CALIBER-main\44CALIBER\obj\Release\Insidious.pdb source: E9NhUneknw.exe

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: Joe Sandbox View

IP Address: 172.67.188.154 172.67.188.154

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp

String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://freegeoip.app
Source: E9NhUneknw.exe, 00000000.00000003.682808349.000000001B654000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobp/1.0/
Source: E9NhUneknw.exe, 00000000.00000003.677573262.000000001B641000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobp/1.0/w
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: E9NhUneknw.exe, E9NhUneknw.exe, 00000000.00000002.684605624.0000000002881000.00000004.00000001.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: E9NhUneknw.exe	String found in binary or memory: https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: E9NhUneknw.exe	String found in binary or memory: https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app
Source: E9NhUneknw.exe	String found in binary or memory: https://freegeoip.app/xml/
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.appx
Source: E9NhUneknw.exe, 00000000.00000002.686752727.0000000002AF0000.00000004.00000001.sdmp, E9NhUneknw.exe, 00000000.00000002.686761919.0000000002AF4000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: E9NhUneknw.exe	String found in binary or memory: https://steamcommunity.com/profiles/
Source: E9NhUneknw.exe	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: freegeoip.app

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture screen (.Net source)

Show sources

Source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Screen.cs

.Net Code: GetScreen

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FE3042	0_2_00007FFA35FE3042
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD0E18	0_2_00007FFA35FD0E18
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FE2296	0_2_00007FFA35FE2296

Source: E9NhUneknw.exe	Binary or memory string: OriginalFilename vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameInsidious.exe6 vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000002.683460236.000000000094A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs E9NhUneknw.exe
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs E9NhUneknw.exe
Source: E9NhUneknw.exe	Binary or memory string: OriginalFilenameInsidious.exe6 vs E9NhUneknw.exe

Source: E9NhUneknw.exe

Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\E9NhUneknw.exe

File read: C:\Users\user\Desktop\E9NhUneknw.exe

Jump to behavior

Source: E9NhUneknw.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: E9NhUneknw.exe, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'
Source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'
Source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, youknowcaliber/Help.cs	Suspicious URL: 'https://api.vimeworld.ru/user/name/'

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\E9NhUneknw.exe

File created: C:\Users\user\AppData\Local\44

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC14B.tmp

Jump to behavior

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@1/9@1/1

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: E9NhUneknw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: E9NhUneknw.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: E9NhUneknw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" source: E9NhUneknw.exe, 00000000.00000003.673158824.0000000000A24000.00000004.00000001.sdmp
Source:	Binary string: .PDBimeS source: E9NhUneknw.exe, 00000000.00000002.683565920.000000000099B000.00000004.00000020.sdmp
Source:	Binary string: E:\44CALIBER-main\44CALIBER-main\44CALIBER\obj\Release\Insidious.pdb source: E9NhUneknw.exe

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD5829 push eax; retf	0_2_00007FFA35FD59DD
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD550A push eax; retf	0_2_00007FFA35FD5563
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD5572 push eax; retf	0_2_00007FFA35FD5573
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Code function: 0_2_00007FFA35FD55A0 push eax; retf	0_2_00007FFA35FD5563

Source: E9NhUneknw.exe

Static PE information: 0xE4DD3EAE [Tue Sep 4 00:39:10 2091 UTC]

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\E9NhUneknw.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\E9NhUneknw.exe TID: 6924	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe TID: 4732	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\E9NhUneknw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\E9NhUneknw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: E9NhUneknw.exe, 00000000.00000002.689373636.000000001D251000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: E9NhUneknw.exe, 00000000.00000002.689373636.000000001D251000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareM4PWCN5RWin32_VideoController_VG81BS9VideoController120060621000000.000000-00035525620display.infMSBDAT721FNDFPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsZERY_XE5rogr
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: E9NhUneknw.exe, 00000000.00000002.689054710.000000001B840000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ
Source: E9NhUneknw.exe, 00000000.00000002.688849319.000000001B240000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Queries volume information: C:\Users\user\Desktop\E9NhUneknw.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\E9NhUneknw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected 44Caliber Stealer

Show sources

Source: Yara match	File source: E9NhUneknw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, type: MEMORY

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\Desktop\E9NhUneknw.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: E9NhUneknw.exe	String found in binary or memory: ElectrumDir
Source: E9NhUneknw.exe, 00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: E9NhUneknw.exe	String found in binary or memory: JaxxDir
Source: E9NhUneknw.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: E9NhUneknw.exe	String found in binary or memory: \Ethereum\keystore
Source: E9NhUneknw.exe	String found in binary or memory: ExodusDir
Source: E9NhUneknw.exe	String found in binary or memory: EthereumDir
Source: E9NhUneknw.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: E9NhUneknw.exe	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\E9NhUneknw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: E9NhUneknw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E9NhUneknw.exe PID: 6904, type: MEMORYSTR

Remote Access Functionality:

Yara detected 44Caliber Stealer

Show sources

Source: Yara match	File source: E9NhUneknw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E9NhUneknw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation121	Path Interception	Path Interception	Masquerading1	OS Credential Dumping1	Query Registry1	Remote Services	Screen Capture1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Security Software Discovery121	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion141	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Local System3	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Virtualization/Sandbox Evasion141	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery33	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
E9NhUneknw.exe	67%	Virustotal		Browse
E9NhUneknw.exe	100%	Avira	HEUR/AGEN.1141546

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.E9NhUneknw.exe.4f0000.0.unpack	100%	Avira	HEUR/AGEN.1141546		Download File
0.0.E9NhUneknw.exe.4f0000.0.unpack	100%	Avira	HEUR/AGEN.1141546		Download File

Domains

Source	Detection	Scanner	Label	Link
freegeoip.app	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://freegeoip.app/xml/	0%	URL Reputation	safe
https://freegeoip.app	0%	URL Reputation	safe
http://ns.adobp/1.0/w	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1	0%	Avira URL Cloud	safe
http://ns.adobp/1.0/	0%	URL Reputation	safe
https://freegeoip.appx	0%	Avira URL Cloud	safe
http://freegeoip.app	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
freegeoip.app	172.67.188.154	true	false	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	E9NhUneknw.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
https://steamcommunity.com/profiles/ASOFTWARE	E9NhUneknw.exe	false		high
https://support.google.com/chrome/answer/6258784	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://freegeoip.app	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
https://support.google.com/chrome/?p=plugin_flash	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
http://ns.adobp/1.0/w	E9NhUneknw.exe, 00000000.00000003.677573262.000000001B641000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://discord.com/api/webhooks/877106556905328661/OyLkuIbHolsGkE_Gsdhp8C-pOzTVH86ebFWF0y5BTWS_pIz1	E9NhUneknw.exe	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/	E9NhUneknw.exe	false		high
https://support.google.com/chrome/?p=plugin_divx	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://api.vimeworld.ru/user/name/	E9NhUneknw.exe, E9NhUneknw.exe, 00000000.00000002.684605624.0000000002881000.00000004.00000001.sdmp	false		high
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	E9NhUneknw.exe	false		high
http://ns.adobp/1.0/	E9NhUneknw.exe, 00000000.00000003.682808349.000000001B654000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false		high
https://freegeoip.appx	E9NhUneknw.exe, 00000000.00000002.686340624.0000000002A48000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high
http://freegeoip.app	E9NhUneknw.exe, 00000000.00000002.686692878.0000000002AD1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	E9NhUneknw.exe, 00000000.00000002.686589364.0000000002AA7000.00000004.00000001.sdmp, tmpC14B.tmp.dat.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.188.154	freegeoip.app	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	466786
Start date:	17.08.2021
Start time:	15:21:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	E9NhUneknw (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@1/9@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 7 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 23.211.5.146, 23.211.6.115 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, arc.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, e16646.dscg.akamaiedge.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, storeedgefd.dsx.mp.microsoft.com Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:23:00	API Interceptor	1x Sleep call for process: E9NhUneknw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.188.154	GCm5dlW06F.exe	Get hash	malicious	Browse	freegeoip.app/json
	ygU1UKPJFM.exe	Get hash	malicious	Browse	freegeoip.app/json
	Lma2EzVvAK.exe	Get hash	malicious	Browse	freegeoip.app/json
	3MndTUzGQn.exe	Get hash	malicious	Browse	freegeoip.app/json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
freegeoip.app	SecuriteInfo.com.Trojan.Inject4.6572.7182.exe	Get hash	malicious	Browse	104.21.19.200
	YNZQJMJmCD.exe	Get hash	malicious	Browse	104.21.19.200
	picture.doc	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Trojan.Inject4.6572.13903.exe	Get hash	malicious	Browse	172.67.188.154
	Remesas Aceptadas_160821.exe	Get hash	malicious	Browse	104.21.19.200
	PO8989843.exe	Get hash	malicious	Browse	172.67.188.154
	CV of Masuduzzaman.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Scr.Malcodegdn30.15691.exe	Get hash	malicious	Browse	104.21.19.200
	Purchase order 4500640396.exe	Get hash	malicious	Browse	104.21.19.200
	QNTTqIOkDs.exe	Get hash	malicious	Browse	172.67.188.154
	NuEv8cMPly.exe	Get hash	malicious	Browse	172.67.188.154
	SOA.exe	Get hash	malicious	Browse	172.67.188.154
	A67AF2D4CCB73E4A9D50D4474825618626C3A48B76C57.exe	Get hash	malicious	Browse	172.67.188.154
	Dunes Industries P03356.exe	Get hash	malicious	Browse	172.67.188.154
	product layout.exe	Get hash	malicious	Browse	104.21.19.200
	Pro Forma_pdf.exe	Get hash	malicious	Browse	172.67.188.154
	att1-210810233957.pdf___________________________pdf,.exe	Get hash	malicious	Browse	172.67.188.154
	LS9k5AY5q9.exe	Get hash	malicious	Browse	104.21.19.200
	products list.doc	Get hash	malicious	Browse	104.21.19.200
	Invoice for Authorized.exe	Get hash	malicious	Browse	104.21.19.200

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	PO NO. P0008005.exe	Get hash	malicious	Browse	162.159.130.233
	ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.65262571.xlsm	Get hash	malicious	Browse	104.16.18.94
	ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.65262571.xlsm	Get hash	malicious	Browse	104.16.19.94
	swift.xlsx	Get hash	malicious	Browse	23.227.38.74
	com.mysdkdialy.bpanaysis.apk	Get hash	malicious	Browse	104.21.18.29
	com.mysdkdialy.bpanaysis.apk	Get hash	malicious	Browse	104.21.18.29
	Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_983055157.xlsm	Get hash	malicious	Browse	162.159.133.233
	Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_983055157.xlsm	Get hash	malicious	Browse	162.159.133.233
	ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.46034995.xlsm	Get hash	malicious	Browse	104.16.19.94
	INV 0003847400004857 INV 0038474789.exe	Get hash	malicious	Browse	162.159.129.233
	ACCOUNTINGSEC_SANB.US_CTC_LCL_Import_Tariffs.2021.08.16.46034995.xlsm	Get hash	malicious	Browse	104.16.19.94
	SecuriteInfo.com.Trojan.Inject4.6572.7182.exe	Get hash	malicious	Browse	104.21.19.200
	YNZQJMJmCD.exe	Get hash	malicious	Browse	104.21.19.200
	8K9JGOijfF.exe	Get hash	malicious	Browse	23.227.38.74
	picture.doc	Get hash	malicious	Browse	104.21.19.200
	Dubia Order_PO74555.exe	Get hash	malicious	Browse	172.67.203.175
	SecuriteInfo.com.Trojan.Inject4.6572.13903.exe	Get hash	malicious	Browse	172.67.188.154
	CoTBJ1Q7aG.exe	Get hash	malicious	Browse	104.21.84.71
	9yWcRlZgLk.exe	Get hash	malicious	Browse	104.21.84.71
	payments file.exe	Get hash	malicious	Browse	23.227.38.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.Trojan.Inject4.6572.7182.exe	Get hash	malicious	Browse	172.67.188.154
	YNZQJMJmCD.exe	Get hash	malicious	Browse	172.67.188.154
	Setup.exe	Get hash	malicious	Browse	172.67.188.154
	SecuriteInfo.com.Trojan.Inject4.6572.13903.exe	Get hash	malicious	Browse	172.67.188.154
	Invoice.vbs	Get hash	malicious	Browse	172.67.188.154
	Y03140-Payment-Inv0ice.vbs	Get hash	malicious	Browse	172.67.188.154
	Y16531-Payment-Inv0ice.vbs	Get hash	malicious	Browse	172.67.188.154
	eufive_20210816-144801.exe	Get hash	malicious	Browse	172.67.188.154
	Y16530-Payment-Inv0ice.vbs	Get hash	malicious	Browse	172.67.188.154
	Remesas Aceptadas_160821.exe	Get hash	malicious	Browse	172.67.188.154
	Y03156-Payment-Inv0ice.vbs	Get hash	malicious	Browse	172.67.188.154
	PO8989843.exe	Get hash	malicious	Browse	172.67.188.154
	OGdgVhHvfN.exe	Get hash	malicious	Browse	172.67.188.154
	ufTDCFg8uS.exe	Get hash	malicious	Browse	172.67.188.154
	UcwJnsyCZM.exe	Get hash	malicious	Browse	172.67.188.154
	zfIIQ6GWAy.exe	Get hash	malicious	Browse	172.67.188.154
	SecuriteInfo.com.Scr.Malcodegdn30.15691.exe	Get hash	malicious	Browse	172.67.188.154
	2Lmm1fAL0D.exe	Get hash	malicious	Browse	172.67.188.154
	Purchase order 4500640396.exe	Get hash	malicious	Browse	172.67.188.154
	QNTTqIOkDs.exe	Get hash	malicious	Browse	172.67.188.154

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\44\Browsers\Cookies_Google(45).txt Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.793251994358385
Encrypted:	false
SSDEEP:	6:Pk3rqWwNXUEbhTqKxUNHdHZ2HmwhZZZHwFnAVnn:c7toUwsb9HZ2pHRtn
MD5:	D9DBCC56C259A9BB9C14D81579A3CA21
SHA1:	AEA5970F87BB495E05AAD919B03B6CC6A154AD03
SHA-256:	731E41D8C3DAFA2D161BF8D1E818D99E69C9D0981A4EFDC4E7CEF6126A0C2E31
SHA-512:	EE9A56AC29E5BDAB0492569C14D043F3005A161D73B31F71C61D1FE210ADDBBF1CFB7331C5150E0F6C2A6D4DEA6774CA6786DC1081C7FFC383B80993206405C5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.google.com.TRUE./.FALSE.13261735795164740.NID.204=TAJoBZJmGymg7hmIhx3Pl2B_ihALX0aygaD3k_6aC7ZxEK7XXCNSCdw1ngcPD2GKb8blK9BMvnrjIC7LQudAB_6nqtij7uM-AmmmXBhTbFN20087xdr3Z7uOpVj33C0KRQne2C-F8m9XNwnFH3I5zkA8uxAkwvE0BSBiqum7_78..

C:\Users\user\AppData\Local\44\Information.txt Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	638
Entropy (8bit):	4.19631480123807
Encrypted:	false
SSDEEP:	6:pYcCFWl4BjJQVIKwvg7ywSTe6/Rhw6u0GAY7V4WZiAF51X:pYzd6g477STeITVg7VTZLF51X
MD5:	CD3E35283D3A37125FCDAE65EA1D4524
SHA1:	E887028DF47A69CCA5707668F3F58B22E61DB3D9
SHA-256:	8A8A8A792750486EC236CBE40499DD065BC696876058372F1904B5A4DCA6D68B
SHA-512:	8A4B5E5BE29665CDCF6C15BBCBF695DBD25240FAFA39AF386A66D9B08BE9B53EC3C1AC0880FA69AFCFBEFA1747DAA066183373778D4927EB86E0FFE84C1166E2
Malicious:	false
Reputation:	low
Preview:	==================================================. Operating system: Windows 10 Pro (64 Bit). PC user: 701188/user. ClipBoard: . Launch: C:\Users\user\Desktop\E9NhUneknw.exe. ==================================================. Screen resolution: 1280x1024. Current time: 8/17/2021 3:22:58 PM. HWID: 28C2ADA153. ==================================================. CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz. RAM: 4093MB. GPU: T721FNDF. ==================================================. IP Geolocation: 84.17.52.77 [Switzerland]. Log Date: 08/17/2021 3:22. BSSID: 00:0c:29:82:cb:33. ==================================================

C:\Users\user\AppData\Local\44\Process.txt Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	4.788762914310138
Encrypted:	false
SSDEEP:	48:AV7SHetIsgtZWtkN1NqXrJs559vU2DmsetQ7ZB:k7Dt6gtkRQWUztQ7T
MD5:	C51D0E2AB326594DEDD912B1FE4B923D
SHA1:	EF7894AA9A761796177F5E67C86A38397533FA55
SHA-256:	F212654BF3E43E768A05461C58720CDCAF2F41C0EEA4E6F98CCE092A57827E3E
SHA-512:	86F382FF9E6243FA156C41BF74B1AB191E628F487CBCE3665E3DC58273BB272E4EFB6BC952AEFCAC89A5D18BA12683A87AED9AB763987B44AADF0C667BEB2021
Malicious:	false
Reputation:	low
Preview:	NAME: tjjxyLnvbXUNdyuUqQGF..NAME: svchost..NAME: svchost..NAME: RuntimeBroker..NAME: svchost..NAME: svchost..NAME: svchost..NAME: winlogon..NAME: svchost..NAME: svchost..NAME: dllhost..NAME: services..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: smartscreen..NAME: svchost..NAME: svchost..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: backgroundTaskHost..NAME: svchost..NAME: svchost..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: svchost..NAME: svchost..NAME: svchost..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: svchost..NAME: svchost..NAME: svchost..NAME: svchost..NAME: WmiPrvSE..NAME: fontdrvhost..NAME: ctfmon..NAME: RuntimeBroker..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: svchost..NAME: msiexec..NAME: svchost..NAME: svchost..NAME: svchost..NAME: svchost..NAME: backgroundTaskHost..NAME: spoolsv..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: SgrmBroker..NAME: svchost..NAME: svchost..NAME: tjjxyLnvbXUNdyuUqQGF..NAME: WmiPrvSE..NAME: svchost..NAME: smss

C:\Users\user\AppData\Local\44\Screen.png Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	826573
Entropy (8bit):	7.945090030653015
Encrypted:	false
SSDEEP:	24576:cQD1VQnOcLtDolyU8TNxskCkWSSu5c5JSvxq8yMVG:pBVmRolyfRxtW6sS885w
MD5:	D24D27233A3E246AC07E54F7150821C5
SHA1:	28B312D8C829F2608EFE22BB3AFF022613047F8B
SHA-256:	AF10981F0FD1E7FEF08E2072ACE6C090065848DD570AE0E8CA472600191D04A2
SHA-512:	D6A622B0F3910BF75DC0AB53238C9D7F3F56307C28233A581E15F57A135D7D97CE513009BD5720F5C1E8A0F99D84B59A212DA193CE25B668BEF3881777F022D1
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...%Ey.?._......a.}.....F.>.5&.o....q.b.Ed..}.EpE.T..W\Q..Y....`.....S.O....UwU.>.=...........s...?.,..)..>.,X.4..F.].F.l.7.3.?...v...Y..6.......,zN3.?7d..C\|:...c.f;.#..x..`.g.......c...ms.....Z..`.'9f.^.<Z\?...,...T..J....y.s.df.......Q.g6.X.>......].\....S.....lf7 ..Y.....~.....q.{B......F......l.Np_H..O._o.9f..D..E!..A.3..[%j\|..4W...w..T.0.......=2....,.6.0.)v4.6.pl.l.....-v63....`..[>?f.]..e.0.h.@e6....p...[.^...P......p.,..~].....{%.......O\|.w./`,....m.k.\|....?....E..n.9..l...].........e.... hs{...{..:}.m...?)...q...d....-.+.}9t..5.l.j{..E...a....x.L...}...}......lG....@..,.....?u1..@)p.....L}t.6.....4u.^.A.$.Y.._..S.8..m:.M.!...~).........0F.D.zO.-.e.S3...L.`..\|mL.`o....EY.1..`...\...G........#...Zl.k2V&\..@mM..-4.?..41d~.Cu.'cT.N7o.X...c...e[P..(-.......=.\|...........`2j.pS..$hP..]"...H...j..O.Z...V.~.. \|=@.v......_#;..P$..{.^#.j..#.9. o@x...c

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\E9NhUneknw.exe.log Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.35852734882506
Encrypted:	false
SSDEEP:	24:ML9E4Kr0AE4KKPF1qE4GiDCKDE4KGKN08AKhPKIE4TKD1KoPE4KeGasXE4+Y:MxHKIAHKKPF1qHGiDCYHKGD8AoPtHTGM
MD5:	11041206508C8E3C6CAEDB7DE2DE7B31
SHA1:	533583B3FABDF61B9701F01B62ADFDB68C675193
SHA-256:	4DE53D0644823C319F087A170932449E1CD1D9CF10EEA5E53C46874BF80EC6D4
SHA-512:	7231A42169973A892BBA1EF50FB879FFD594A9C63DED191E32E3DA42DAD06CFB79FFC1C59C72A322DCEF7AEE69C7D3305A7B77E205FD873AB5E0ED1719509E48
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\f2e3165e3c718b7ac302fea40614c984\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\e82398e9ff

C:\Users\user\AppData\Local\Temp\tmpC14B.tmp.dat Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC3DC.tmp.dat Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC3DD.tmp.dat Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC797.tmp.dat Download File
Process:	C:\Users\user\Desktop\E9NhUneknw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.850595235789631
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	E9NhUneknw.exe
File size:	281088
MD5:	f3d648c4f3a0f9cfbead90e546efe8f6
SHA1:	cba4d6e13b5f1e766914ef65ff50c19bb295c17f
SHA256:	cd80318bc4c724934435231e72cbf7cbf5942df8b36e480603237e2ed08d4a93
SHA512:	bdeae22637a4be786fe8c4ef59ef35aeb4de2c339fc1728c47a8fd148528cb4ab92f84e6839727275f2d14d131a95d477ee50b8800aaa17a538f8bef1c04b213
SSDEEP:	6144:Rf+BLtABPD9NF/DVGK7zeNL+dN41V6GIeyXiRA1D0bBi:HNKK7zeNL2Y69eyXH1Dai
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>............"...0..@...........8... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4438ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xE4DD3EAE [Tue Sep 4 00:39:10 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
adc byte ptr [ecx], dl
adc al, byte ptr [eax]
or byte ptr [edi], al
or dword ptr [esi], eax
or al, byte ptr [030C040Bh]
or eax, 0F010E02h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], cl
or byte ptr [eax], al
mov word ptr [eax], es
or byte ptr [eax], al
dec esp
add byte ptr [eax], cl
add ah, cl
add byte ptr [eax], cl
add byte ptr [eax+eax], ch
or byte ptr [eax], al
lodsb
add byte ptr [eax], cl
add byte ptr [eax+eax+08h], ch
add ah, ch
add byte ptr [eax], cl
add byte ptr [eax+eax], bl
or byte ptr [eax], al
pushfd
add byte ptr [eax], cl
add byte ptr [eax+eax+08h], bl
add ah, bl
add byte ptr [eax], cl
add byte ptr [eax+eax], bh
or byte ptr [eax], al
mov esp, 7C000800h
add byte ptr [eax], cl
add ah, bh
add byte ptr [eax], cl
add byte ptr [edx], al
add byte ptr [eax], cl
add byte ptr [edx+42000800h], al
add byte ptr [eax], cl
add dl, al
add byte ptr [eax], cl
add byte ptr [edx], ah
add byte ptr [eax], cl
add byte ptr [edx+62000800h], ah
add byte ptr [eax], cl
add dl, ah
add byte ptr [eax], cl
add byte ptr [edx], dl
add byte ptr [eax], cl
add byte ptr [edx+52000800h], dl
add byte ptr [eax], cl
add dl, dl
add byte ptr [eax], cl
add byte ptr [edx], dh
add byte ptr [eax], cl
add byte ptr [edx+72000800h], dh
add byte ptr [eax], cl
add dl, dh
add byte ptr [eax], cl
add byte ptr [edx], cl
add byte ptr [eax], cl
add byte ptr [edx+4A000800h], cl
add byte ptr [eax], cl
add dl, cl
add byte ptr [eax], cl
add byte ptr [edx], ch
add byte ptr [eax], cl
add byte ptr [edx+6A000800h], ch
add byte ptr [eax], cl
add dl, ch
add byte ptr [eax], cl
add byte ptr [edx], bl
add byte ptr [eax], cl
add byte ptr [edx+5A000800h], bl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43859	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x437c4	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x43ea4	0x44000	False	0.405406278722	data	5.86576439242	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x5f8	0x600	False	0.436197916667	data	4.26450320102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x46090	0x368	data
RT_MANIFEST	0x46408	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	FuckTheSystem Copyright 2021
Assembly Version	1.6.2.0
InternalName	Insidious.exe
FileVersion	1.6.2.0
CompanyName	44 CALIBER
LegalTrademarks
Comments	44 CALIBER
ProductName	44 CALIBER
ProductVersion	1.6.2.0
FileDescription	44 CALIBER
OriginalFilename	Insidious.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 17, 2021 15:22:57.582362890 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.602374077 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.603322029 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.699497938 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.716478109 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.722636938 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.722662926 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.723505020 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.737153053 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.755733967 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.755919933 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.805984974 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.837450981 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:22:57.854295969 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.902524948 CEST	443	49733	172.67.188.154	192.168.2.4
Aug 17, 2021 15:22:57.946604013 CEST	49733	443	192.168.2.4	172.67.188.154
Aug 17, 2021 15:23:00.534367085 CEST	49733	443	192.168.2.4	172.67.188.154

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 17, 2021 15:22:47.596992016 CEST	64646	53	192.168.2.4	8.8.8.8
Aug 17, 2021 15:22:47.643656969 CEST	53	64646	8.8.8.8	192.168.2.4
Aug 17, 2021 15:22:48.499253988 CEST	65298	53	192.168.2.4	8.8.8.8
Aug 17, 2021 15:22:48.539207935 CEST	53	65298	8.8.8.8	192.168.2.4
Aug 17, 2021 15:22:49.662826061 CEST	59123	53	192.168.2.4	8.8.8.8
Aug 17, 2021 15:22:49.697448015 CEST	53	59123	8.8.8.8	192.168.2.4
Aug 17, 2021 15:22:57.520706892 CEST	54531	53	192.168.2.4	8.8.8.8
Aug 17, 2021 15:22:57.558878899 CEST	53	54531	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 17, 2021 15:22:57.520706892 CEST	192.168.2.4	8.8.8.8	0x99f4	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 17, 2021 15:22:57.558878899 CEST	8.8.8.8	192.168.2.4	0x99f4	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Aug 17, 2021 15:22:57.558878899 CEST	8.8.8.8	192.168.2.4	0x99f4	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 17, 2021 15:22:57.722662926 CEST	172.67.188.154	443	192.168.2.4	49733	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Aug 11 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Thu Aug 11 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Aug 17, 2021 15:22:57.722662926 CEST	172.67.188.154	443	192.168.2.4	49733	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: E9NhUneknw.exe PID: 6904 Parent PID: 6528

General

Start time:	15:22:52
Start date:	17/08/2021
Path:	C:\Users\user\Desktop\E9NhUneknw.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\E9NhUneknw.exe'
Imagebase:	0x4f0000
File size:	281088 bytes
MD5 hash:	F3D648C4F3A0F9CFBEAD90E546EFE8F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.667396835.00000000004F2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.683309433.00000000004F2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.685062337.000000000292E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: E9NhUneknw.exe PID: 6904 Parent PID: 6528 E9NhUneknw.exeCOMMON

Executed Functions

Function 00007FFA35FDC4B9, Relevance: 1.8, APIs: 1, Instructions: 321encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFA35FDC6D0

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 768cf879be7fc56d06ecc753e33144b8fb7f487a52c280c03d481f1edc4e7c9e
Instruction ID: 4d16a889c597abcf9d1b06eef1fa2c104349502ab58ff4fd2c13a2366f9e6757
Opcode Fuzzy Hash: 768cf879be7fc56d06ecc753e33144b8fb7f487a52c280c03d481f1edc4e7c9e
Instruction Fuzzy Hash: 13A1E131908A5D8FDBA9DB589845BF8BBE0FF56310F0081AAD40DD7252CE35A986CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FD557A, Relevance: 1.8, APIs: 1, Instructions: 270encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFA35FDC6D0

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 11d0a135a73e24135ba622e422c572baf100840ffe6b97626825ec05f529ce0c
Instruction ID: 3f76bc49df4977e0042cf7840517eeecdd0cb13fb99dd40edd84b1c5c5b95284
Opcode Fuzzy Hash: 11d0a135a73e24135ba622e422c572baf100840ffe6b97626825ec05f529ce0c
Instruction Fuzzy Hash: 3A917271908A1D8FDBA8DF58D845BE9B7E1FB59310F0081AED40EE3252CE75A985CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FD0E18, Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce710e9a58685d9749df418f66acf9b5c5008de4da7fe2fee71bf8a9d90d140f
Instruction ID: c097f1b706fdfc0c3b3770ce6834cc09d2bc77edb2d8a764aa6079bb4c793cee
Opcode Fuzzy Hash: ce710e9a58685d9749df418f66acf9b5c5008de4da7fe2fee71bf8a9d90d140f
Instruction Fuzzy Hash: 15F1D926D0824A8FEB11F7ACEC965FA7BE4EF47714F0580B6D04CC7197EE28A8468751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FE2296, Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6c55b3e403e0b48d51ae6226067deca64fcccaa66f1b2328018dc0e3fb09f7
Instruction ID: 5f3a5f66b15fa174fed4b8e87b9b3c731bd992eb48f9a4548ef2c66a9f3d2e18
Opcode Fuzzy Hash: 0f6c55b3e403e0b48d51ae6226067deca64fcccaa66f1b2328018dc0e3fb09f7
Instruction Fuzzy Hash: B9F1A130908A8E8FEBA8DF2CC8557E937D1FF55710F04826AE84DC7291DF35A9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FE3042, Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad071f1b73a0bd832ae263a4f25b49a07891c9776ca96d0ea29b5c19a2cffa5
Instruction ID: f2a4941a73c7ed8f99fc9da2bc111114befea7103bb657dc8b7bdb2f065611d3
Opcode Fuzzy Hash: 3ad071f1b73a0bd832ae263a4f25b49a07891c9776ca96d0ea29b5c19a2cffa5
Instruction Fuzzy Hash: 35E1B230908A8E8FEBA8DF2CD8597E977D1EF55710F04826ED84DC7291DE79A8448781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FDCAD0, Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 533COMMON

Download Yara Rule

Strings

KDBM, xrefs: 00007FFA35FDCE5A
v\_^, xrefs: 00007FFA35FDCBB1

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID:
String ID: KDBM$v\_^
API String ID: 0-3641222329
Opcode ID: 11e72abd07d99898c1f4d00df9eeb1f09a8d2c30243d2be6d11cd0917e983cb8
Instruction ID: 48e77fd855d732fa6de8282e28e45e69c91689e6d1562dcb2ade2b0284033042
Opcode Fuzzy Hash: 11e72abd07d99898c1f4d00df9eeb1f09a8d2c30243d2be6d11cd0917e983cb8
Instruction Fuzzy Hash: EEF1F96390C7C74EE715A7AC68960F57FD0EF43B24B0480B7D18C8B197DD15680ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35FE4D60, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

SendARP.IPHLPAPI ref: 00007FFA35FE4E38

Memory Dump Source

Source File: 00000000.00000002.689868940.00007FFA35FD0000.00000040.00000001.sdmp, Offset: 00007FFA35FD0000, based on PE: false

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 12606a9479b12e3bddf4e7f9c676cb95ecbbafd98f3634f54c2461563e9eca5f
Instruction ID: 626d372fa1cbe779024a5ddc6e4e0b3c13e46f99e1d0c77b9bb14a15648d1082
Opcode Fuzzy Hash: 12606a9479b12e3bddf4e7f9c676cb95ecbbafd98f3634f54c2461563e9eca5f
Instruction Fuzzy Hash: 1541F23190DB898FDB19DBAC9C556E8BFF0FB96321F0442AFD049C7192CB646805CB92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report E9NhUneknw

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: 44Caliber Stealer

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics