Windows Analysis Report vXVHRRGG7c.exe

Overview

General Information

Sample Name: vXVHRRGG7c.exe
Analysis ID: 490261
MD5: 051c20fd814ac34ffcfadd56ec872be0
SHA1: 6d4d301594ba01b9e4d8eac59dc839090f090fdf
SHA256: 7aa215495949e721b9ae8b3b28cb728ac3b3240438e67f2cc4f3be2711d3d319
Tags: exeTrickBot
Infos:

Most interesting Screenshot:

Detection

TrickBot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Trickbot
Multi AV Scanner detection for submitted file
Multi AV Scanner detection for dropped file
Writes to foreign memory regions
Allocates memory in foreign processes
May check the online IP address of the machine
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Potential key logger detected (key state polling based)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.304704482.00000000024A1000.00000040.00000001.sdmp Malware Configuration Extractor: Trickbot {"ver": "2000033", "gtag": "tot153", "servs": ["179.42.137.102:443", "191.36.152.198:443", "179.42.137.104:443", "179.42.137.106:443", "179.42.137.108:443", "202.183.12.124:443", "194.190.18.122:443", "103.56.207.230:443", "171.103.187.218:443", "171.103.189.118:443", "18.139.111.104:443", "179.42.137.105:443", "186.4.193.75:443", "171.101.229.2:443", "179.42.137.107:443", "103.56.43.209:443", "179.42.137.110:443", "45.181.207.156:443", "197.44.54.162:443", "179.42.137.109:443", "103.59.105.226:443", "45.181.207.101:443", "117.196.236.205:443", "72.224.45.102:443", "179.42.137.111:443", "96.47.239.181:443", "171.100.112.190:443", "117.196.239.6:443"], "autorun": ["pwgrabb", "pwgrabc"], "ecc_key": "RUNTMzAAAAAL/ZqmMPBLaRfg1hPOtFJrZz2Zi2/EC4B3fiX8VnaOUVKndBr+jEqWc7mw4v3ADTiwp64K5QKe1LZ27jUZxL4bWjxARPo85hv72nuedeZhRQ+adQQ/gIsV869MycRzghc="}
Multi AV Scanner detection for submitted file
Source: vXVHRRGG7c.exe ReversingLabs: Detection: 22%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe ReversingLabs: Detection: 22%

Compliance:

barindex
Uses 32bit PE files
Source: vXVHRRGG7c.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: K:\HistogramTest\Release\HistogramTest.pdb source: vXVHRRGG7c.exe
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041D4AF __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA, 1_2_0041D4AF
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041D9C5 FindFirstFileA,FindClose, 1_2_0041D9C5
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0041D4AF __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA, 10_2_0041D4AF
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0041D9C5 FindFirstFileA,FindClose, 10_2_0041D9C5

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404342 ET CNC Feodo Tracker Reported CnC Server TCP group 22 192.168.2.3:49719 -> 59.4.68.75:443
May check the online IP address of the machine
Source: C:\Windows\System32\wermgr.exe DNS query: name: icanhazip.com
Source: C:\Windows\System32\wermgr.exe DNS query: name: icanhazip.com
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TelefonicadeArgentinaAR TelefonicadeArgentinaAR
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.7.156 104.18.7.156
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49716 -> 171.103.189.118:449
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.102
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown TCP traffic detected without corresponding DNS query: 179.42.137.105
Source: unknown DNS traffic detected: queries for: icanhazip.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.76.0Host: icanhazip.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: vXVHRRGG7c.exe, 00000001.00000002.303924886.000000000078A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00423386 GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA, 1_2_00423386
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0042339B GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA,SendMessageA,GetParent, 1_2_0042339B
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041AA1B GetKeyState,GetKeyState,GetKeyState,GetKeyState, 1_2_0041AA1B
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00417DEB GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 1_2_00417DEB
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00423386 GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA, 10_2_00423386
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0042339B GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA,SendMessageA,GetParent, 10_2_0042339B
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0041AA1B GetKeyState,GetKeyState,GetKeyState,GetKeyState, 10_2_0041AA1B
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00417DEB GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 10_2_00417DEB

System Summary:

barindex
Uses 32bit PE files
Source: vXVHRRGG7c.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Detected potential crypto function
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0040A361 1_2_0040A361
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004147A0 1_2_004147A0
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00416AD2 1_2_00416AD2
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0040EF5A 1_2_0040EF5A
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A4CD0 1_2_024A4CD0
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0040A361 10_2_0040A361
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_004147A0 10_2_004147A0
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00416AD2 10_2_00416AD2
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0040EF5A 10_2_0040EF5A
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01264CD0 10_2_01264CD0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: String function: 00405A18 appears 98 times
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: String function: 004244B5 appears 35 times
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: String function: 00405A18 appears 98 times
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: String function: 004244B5 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00403C23 KiUserCallbackDispatcher,LoadLibraryW,ExitProcess,GetCurrentThread,QueueUserAPC,NtTestAlert, 1_2_00403C23
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00403CE2 GetCurrentThread,QueueUserAPC,NtTestAlert, 1_2_00403CE2
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00403C23 LoadLibraryW,ExitProcess,GetCurrentThread,QueueUserAPC,NtTestAlert, 10_2_00403C23
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00403CE2 GetCurrentThread,QueueUserAPC,NtTestAlert, 10_2_00403CE2
Sample file is different than original file name gathered from version info
Source: vXVHRRGG7c.exe, 00000001.00000002.303499051.0000000000435000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHistogramTest.EXET vs vXVHRRGG7c.exe
Source: vXVHRRGG7c.exe, 0000000A.00000002.400503286.0000000000435000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHistogramTest.EXET vs vXVHRRGG7c.exe
Source: vXVHRRGG7c.exe Binary or memory string: OriginalFilenameHistogramTest.EXET vs vXVHRRGG7c.exe
PE file contains strange resources
Source: vXVHRRGG7c.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vXVHRRGG7c.exe.3.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vXVHRRGG7c.exe ReversingLabs: Detection: 22%
Source: vXVHRRGG7c.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\vXVHRRGG7c.exe 'C:\Users\user\Desktop\vXVHRRGG7c.exe'
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c 'C:\Users\user\AppData\Local\browDownload3D\cmd01.bat'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe Jump to behavior
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe Jump to behavior
Source: C:\Windows\System32\wermgr.exe System information queried: HandleInformation Jump to behavior
Source: C:\Windows\System32\wermgr.exe File created: C:\Users\user\AppData\Local\browDownload3D Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@13/3@6/6
Source: C:\Windows\System32\wermgr.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wermgr.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{12477072-E440-07DC-0361-112BF0B8DF37}
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:5676:120:WilError_01
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041B297 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow, 1_2_0041B297
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c 'C:\Users\user\AppData\Local\browDownload3D\cmd01.bat'
Source: C:\Windows\System32\wermgr.exe File written: C:\Users\user\AppData\Local\browDownload3D\settings.ini Jump to behavior
Source: C:\Windows\System32\wermgr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\wermgr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\wermgr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: vXVHRRGG7c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: K:\HistogramTest\Release\HistogramTest.pdb source: vXVHRRGG7c.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00405A18 push eax; ret 1_2_00405A36
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00407AE0 push eax; ret 1_2_00407B0E
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A2C90 push dword ptr [edx+14h]; ret 1_2_024A2D9D
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A4046 push eax; iretd 1_2_024A4048
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A5B40 push edx; iretd 1_2_024A5B77
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A4872 push es; iretd 1_2_024A487B
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A3FA7 push 61992208h; ret 1_2_024A3FAC
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_024A2D39 push dword ptr [edx+14h]; ret 1_2_024A2D9D
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00405A18 push eax; ret 10_2_00405A36
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00407AE0 push eax; ret 10_2_00407B0E
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01262C90 push dword ptr [edx+14h]; ret 10_2_01262D9D
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01264046 push eax; iretd 10_2_01264048
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01264872 push es; iretd 10_2_0126487B
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01265B40 push edx; iretd 10_2_01265B77
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01262D39 push dword ptr [edx+14h]; ret 10_2_01262D9D
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_01263FA7 push 61992208h; ret 10_2_01263FAC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004186ED GetModuleHandleA,LoadLibraryA,GetProcAddress,#17,#17,FreeLibrary, 1_2_004186ED

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Windows\System32\wermgr.exe File created: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0042343E IsWindowVisible,IsIconic, 1_2_0042343E
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004044B0 IsIconic, 1_2_004044B0
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004126B0 GetPropA,CallWindowProcA,CallWindowProcA,IsIconic,CallWindowProcA,GetWindowLongA,SendMessageA,CallWindowProcA,CallWindowProcA,GetWindowLongA,GetClassNameA,lstrcmpA,CallWindowProcA,GetWindowLongA,CallWindowProcA,CallWindowProcA,CallWindowProcA, 1_2_004126B0
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00404767 IsIconic,GetWindowPlacement,GetWindowRect, 1_2_00404767
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00411F00 CallWindowProcA,DefWindowProcA,IsIconic,SendMessageA,GetWindowLongA,GetWindowLongA,GetWindowDC,GetWindowRect,InflateRect,InflateRect,SelectObject,OffsetRect,SelectObject,ReleaseDC, 1_2_00411F00
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0042343E IsWindowVisible,IsIconic, 10_2_0042343E
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_004044B0 IsIconic, 10_2_004044B0
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_004126B0 GetPropA,CallWindowProcA,CallWindowProcA,IsIconic,CallWindowProcA,GetWindowLongA,SendMessageA,CallWindowProcA,CallWindowProcA,GetWindowLongA,GetClassNameA,lstrcmpA,CallWindowProcA,GetWindowLongA,CallWindowProcA,CallWindowProcA,CallWindowProcA, 10_2_004126B0
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00404767 IsIconic,GetWindowPlacement,GetWindowRect, 10_2_00404767
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00411F00 CallWindowProcA,DefWindowProcA,IsIconic,SendMessageA,GetWindowLongA,GetWindowLongA,GetWindowDC,GetWindowRect,InflateRect,InflateRect,SelectObject,OffsetRect,SelectObject,ReleaseDC, 10_2_00411F00
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00424D9A LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary, 1_2_00424D9A
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Source: C:\Windows\System32\wermgr.exe Function Chain: threadCreated,threadDelayed,threadDelayed,userTimerSet,threadDelayed,threadDelayed,fileVolumeQueried,languageOrLocalQueried,languageOrLocalQueried,adjustToken,systemQueried,systemQueried,threadDelayed,threadDelayed,mutantCreated,threadInformationSet,threadInformationSet,threadInformationSet,threadInformationSet,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,fileOpened
Source: C:\Windows\System32\wermgr.exe Function Chain: threadCreated,threadDelayed,threadDelayed,userTimerSet,threadDelayed,threadDelayed,fileVolumeQueried,languageOrLocalQueried,languageOrLocalQueried,adjustToken,systemQueried,systemQueried,threadDelayed,threadDelayed,threadInformationSet,threadInformationSet,threadInformationSet
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\System32\wermgr.exe RDTSC instruction interceptor: First address: 00000200C1644200 second address: 00000200C1644200 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [00020816h] 0x00000013 mov ecx, 7FFE0320h 0x00000018 dec eax 0x00000019 mov ecx, dword ptr [ecx] 0x0000001b mov eax, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 imul eax, ecx 0x00000026 dec eax 0x00000027 shr eax, 18h 0x0000002a ret 0x0000002b inc esp 0x0000002c mov esi, eax 0x0000002e dec ecx 0x0000002f mov ebx, edi 0x00000031 dec eax 0x00000032 xor ebx, FFFFFF00h 0x00000038 dec ecx 0x00000039 and ebx, edi 0x0000003b call 00007F21ACC1B026h 0x00000040 rdtsc
Source: C:\Windows\System32\wermgr.exe RDTSC instruction interceptor: First address: 0000025C6A134200 second address: 0000025C6A134200 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [00020816h] 0x00000013 mov ecx, 7FFE0320h 0x00000018 dec eax 0x00000019 mov ecx, dword ptr [ecx] 0x0000001b mov eax, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 imul eax, ecx 0x00000026 dec eax 0x00000027 shr eax, 18h 0x0000002a ret 0x0000002b inc esp 0x0000002c mov esi, eax 0x0000002e dec ecx 0x0000002f mov ebx, edi 0x00000031 dec eax 0x00000032 xor ebx, FFFFFF00h 0x00000038 dec ecx 0x00000039 and ebx, edi 0x0000003b call 00007F21ACB53916h 0x00000040 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe TID: 5920 Thread sleep count: 140 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\wermgr.exe Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041D4AF __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA, 1_2_0041D4AF
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0041D9C5 FindFirstFileA,FindClose, 1_2_0041D9C5
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0041D4AF __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA, 10_2_0041D4AF
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0041D9C5 FindFirstFileA,FindClose, 10_2_0041D9C5

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004186ED GetModuleHandleA,LoadLibraryA,GetProcAddress,#17,#17,FreeLibrary, 1_2_004186ED
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_02461030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError, 1_2_02461030
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_023E095E mov eax, dword ptr fs:[00000030h] 1_2_023E095E
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_023E0456 mov eax, dword ptr fs:[00000030h] 1_2_023E0456
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_02461030 mov eax, dword ptr fs:[00000030h] 1_2_02461030
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00FB095E mov eax, dword ptr fs:[00000030h] 10_2_00FB095E
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00FB0456 mov eax, dword ptr fs:[00000030h] 10_2_00FB0456
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_00FF1030 mov eax, dword ptr fs:[00000030h] 10_2_00FF1030
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004039E7 LdrFindResource_U,LdrAccessResource,VirtualAllocExNuma,VirtualAlloc,WriteProcessMemory, 1_2_004039E7
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0040B68A SetUnhandledExceptionFilter, 1_2_0040B68A
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_0040B69C SetUnhandledExceptionFilter, 1_2_0040B69C
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0040B68A SetUnhandledExceptionFilter, 10_2_0040B68A
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: 10_2_0040B69C SetUnhandledExceptionFilter, 10_2_0040B69C

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Memory written: C:\Windows\System32\wermgr.exe base: 200C1640000 Jump to behavior
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Memory written: C:\Windows\System32\wermgr.exe base: 7FF7EE4D2860 Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Memory written: C:\Windows\System32\wermgr.exe base: 25C6A130000 Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Memory written: C:\Windows\System32\wermgr.exe base: 7FF7EE4D2860 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Memory allocated: C:\Windows\System32\wermgr.exe base: 200C1640000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Memory allocated: C:\Windows\System32\wermgr.exe base: 25C6A130000 protect: page execute and read and write Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe Jump to behavior
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe Jump to behavior
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\wermgr.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\wermgr.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte, 1_2_004100FD
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 1_2_0040E0FD
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoA,MultiByteToWideChar, 1_2_004100A7
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoW,WideCharToMultiByte, 1_2_004101C0
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 1_2_0040E388
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 1_2_0040E49B
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoA, 1_2_0040E68F
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoA,IsValidCodePage,IsValidLocale, 1_2_0040DF28
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar, 1_2_0040FFEA
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte, 10_2_004100FD
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 10_2_0040E0FD
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoA,MultiByteToWideChar, 10_2_004100A7
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoW,WideCharToMultiByte, 10_2_004101C0
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 10_2_0040E388
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: EnumSystemLocalesA, 10_2_0040E49B
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoA, 10_2_0040E68F
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoA,IsValidCodePage,IsValidLocale, 10_2_0040DF28
Source: C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe Code function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar, 10_2_0040FFEA
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004066CD GetLocalTime,GetSystemTime,GetTimeZoneInformation, 1_2_004066CD
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_004066CD GetLocalTime,GetSystemTime,GetTimeZoneInformation, 1_2_004066CD
Source: C:\Users\user\Desktop\vXVHRRGG7c.exe Code function: 1_2_00424F12 GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA, 1_2_00424F12

Stealing of Sensitive Information:

barindex
Yara detected Trickbot
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.24a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.1260000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.23e052e.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.fb052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.23e052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.fb052e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.400799901.0000000000FF4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.400763097.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304517846.0000000002464000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.400850600.0000000001261000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304704482.00000000024A1000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304177777.00000000023E0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Trickbot
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.24a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.1260000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.23e052e.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.fb052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.vXVHRRGG7c.exe.23e052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.vXVHRRGG7c.exe.fb052e.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.400799901.0000000000FF4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.400763097.0000000000FB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304517846.0000000002464000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.400850600.0000000001261000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304704482.00000000024A1000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.304177777.00000000023E0000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 490261 Sample: vXVHRRGG7c.exe Startdate: 25/09/2021 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Found malware configuration 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Trickbot 2->41 7 vXVHRRGG7c.exe 2->7         started        10 cmd.exe 1 2->10         started        process3 signatures4 43 Writes to foreign memory regions 7->43 45 Allocates memory in foreign processes 7->45 12 wermgr.exe 4 7->12         started        17 cmd.exe 7->17         started        19 vXVHRRGG7c.exe 10->19         started        21 conhost.exe 10->21         started        process5 dnsIp6 29 179.42.137.102, 443, 49692, 49693 TelefonicadeArgentinaAR unknown 12->29 31 179.42.137.105, 443, 49704, 49705 TelefonicadeArgentinaAR unknown 12->31 33 9 other IPs or domains 12->33 27 C:\Users\user\AppData\...\vXVHRRGG7c.exe, PE32 12->27 dropped 47 May check the online IP address of the machine 12->47 49 Tries to detect virtualization through RDTSC time measurements 12->49 51 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 12->51 53 Multi AV Scanner detection for dropped file 19->53 55 Writes to foreign memory regions 19->55 57 Allocates memory in foreign processes 19->57 23 wermgr.exe 19->23         started        25 cmd.exe 19->25         started        file7 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
179.42.137.102
 unknown unknown
22927 TelefonicadeArgentinaAR true
104.18.7.156
 icanhazip.com United States
13335 CLOUDFLARENETUS false
179.42.137.105
 unknown unknown
22927 TelefonicadeArgentinaAR true
59.4.68.75
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
171.103.189.118
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
icanhazip.com 104.18.7.156 true
9.52.17.84.dnsbl-1.uceprotect.net unknown unknown
9.52.17.84.zen.spamhaus.org unknown unknown
9.52.17.84.cbl.abuseat.org unknown unknown
9.52.17.84.b.barracudacentral.org unknown unknown
9.52.17.84.spam.dnsbl.sorbs.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://icanhazip.com/ false
    		high