Windows Analysis Report U57z89iyVo.exe

AV Detection:

Found malware configuration

Source: 0.2.U57z89iyVo.exe.400000.0.unpack

Malware Configuration Extractor: Dridex {"Version": 10111, "C2 list": ["103.9.36.172:443", "103.70.29.126:593", "46.101.175.170:10172"], "RC4 keys": ["CisvU52kuCqMOp5DJVJjX7NpSOgbFn5Z", "BuEjfhtq8TjhQNb5njPJFUKys2hxPATu0lv0D3Dehj6DP2DBu0bINeCHPnMKWBGwRiks5KDBnA"]}

Multi AV Scanner detection for submitted file

Source: U57z89iyVo.exe	Virustotal: Detection: 52%			Perma Link
Source: U57z89iyVo.exe	Metadefender: Detection: 25%			Perma Link
Source: U57z89iyVo.exe	ReversingLabs: Detection: 77%

Antivirus / Scanner detection for submitted sample

Source: U57z89iyVo.exe

Avira: detected

Machine Learning detection for sample

Source: U57z89iyVo.exe

Joe Sandbox ML: detected

Compliance:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Unpacked PE file: 0.2.U57z89iyVo.exe.400000.0.unpack

Uses 32bit PE files

Source: U57z89iyVo.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 103.9.36.172:443 -> 192.168.2.6:49755 version: TLS 1.2

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_0042CEF8 FindFirstFileExW,

0_2_0042CEF8

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 103.9.36.172:443
Source: Malware configuration extractor	IPs: 103.70.29.126:593
Source: Malware configuration extractor	IPs: 46.101.175.170:10172

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.6:49756 -> 103.70.29.126:593
Source: global traffic	TCP traffic: 192.168.2.6:49758 -> 46.101.175.170:10172

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:35:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:19 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:23 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:27 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:31 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:56 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:36:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.0.15Date: Fri, 31 Dec 2021 06:37:33 GMTContent-Type: text/plain; charset=utf-8Connection: close

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 46.101.175.170
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.9.36.172
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.29.126

URLs found in memory or binary data

Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.352919513.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.351024149.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126/
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126/d
Source: U57z89iyVo.exe, 00000000.00000003.570147173.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464053812.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.471924047.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581367661.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.570683538.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552890321.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485741283.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.614292594.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552868744.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.471933911.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440824322.00000000008A5000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447752203.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497414674.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464063915.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511289422.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.456992109.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581377783.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/(
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/3
Source: U57z89iyVo.exe, 00000000.00000003.471933911.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/850
Source: U57z89iyVo.exe, 00000000.00000003.457008319.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485741283.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.614292594.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447752203.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497414674.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511289422.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/AES
Source: U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/C
Source: U57z89iyVo.exe, 00000000.00000003.457008319.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.614292594.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447752203.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464063915.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581377783.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/D
Source: U57z89iyVo.exe, 00000000.00000003.511274333.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/E
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/S
Source: U57z89iyVo.exe, 00000000.00000003.457008319.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485741283.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497414674.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/aphy
Source: U57z89iyVo.exe, 00000000.00000003.485688456.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581367661.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/dll
Source: U57z89iyVo.exe, 00000000.00000003.471924047.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/dllE
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.359259578.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/ll
Source: U57z89iyVo.exe, 00000000.00000003.570683538.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.471933911.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/nced
Source: U57z89iyVo.exe, 00000000.00000003.440667982.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552890321.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.70.29.126:593/osoft
Source: U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.611019614.00000000007CA000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.587873957.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447752203.00000000030DD000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/(
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172//
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/101.175.170/GlobalSign
Source: U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/101.175.170:10172/
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/101.175.170:10172/ication
Source: U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/:
Source: U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/D
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/V
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/iversal
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/n
Source: U57z89iyVo.exe, 00000000.00000003.581377783.00000000030DD000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/rsaenh.dll
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/t
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://103.9.36.172/y
Source: U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/
Source: U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/:
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/GlobalSign
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/K
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/g
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170/r
Source: U57z89iyVo.exe, 00000000.00000003.442351550.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440807882.0000000000899000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440695040.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.497439551.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.447775453.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.457039195.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.614280442.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.442321974.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.472029303.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.511398374.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440652388.00000000030D1000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.611019614.00000000007CA000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.478773734.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/7
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/H
Source: U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440807882.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/Q
Source: U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440807882.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/g
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.364819759.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/h
Source: U57z89iyVo.exe, 00000000.00000003.417156356.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.485816826.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.574622322.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.552931844.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000002.613709229.0000000000839000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000003.587983799.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.581433085.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/ication
Source: U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.440807882.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/l
Source: U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/l?
Source: U57z89iyVo.exe, 00000000.00000002.613851853.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/lC
Source: U57z89iyVo.exe, 00000000.00000003.388406771.0000000000839000.00000004.00000001.sdmp, U57z89iyVo.exe, 00000000.00000003.397252472.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/p
Source: U57z89iyVo.exe, 00000000.00000003.464082503.0000000000839000.00000004.00000001.sdmp	String found in binary or memory: https://46.101.175.170:10172/y

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 103.9.36.172Content-Length: 4850Connection: CloseCache-Control: no-cache

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_004339F9 InternetReadFile,

0_2_004339F9

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 103.9.36.172:443 -> 192.168.2.6:49755 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: U57z89iyVo.exe, 00000000.00000002.611019614.00000000007CA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 0.2.U57z89iyVo.exe.2260000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.U57z89iyVo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.U57z89iyVo.exe.2260000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.U57z89iyVo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.610353807.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.614056439.0000000002260000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_00405150 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW,

0_2_00405150

System Summary:

Uses 32bit PE files

Source: U57z89iyVo.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Detected potential crypto function

Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00405150		0_2_00405150
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004167C8		0_2_004167C8
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00421020		0_2_00421020
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041D030		0_2_0041D030
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004188C0		0_2_004188C0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00418CC0		0_2_00418CC0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0040ACD0		0_2_0040ACD0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041A0D0		0_2_0041A0D0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004198DA		0_2_004198DA
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041E0A0		0_2_0041E0A0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042DCA0		0_2_0042DCA0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004250A0		0_2_004250A0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00424CA0		0_2_00424CA0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00425CB0		0_2_00425CB0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00417564		0_2_00417564
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00401570		0_2_00401570
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041FDD0		0_2_0041FDD0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004289F0		0_2_004289F0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004271F0		0_2_004271F0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041D980		0_2_0041D980
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042D180		0_2_0042D180
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041C590		0_2_0041C590
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0040F9A0		0_2_0040F9A0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00421240		0_2_00421240
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041A660		0_2_0041A660
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00427660		0_2_00427660
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00422E60		0_2_00422E60
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00409E70		0_2_00409E70
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00419E70		0_2_00419E70
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0040CA10		0_2_0040CA10
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042FA10		0_2_0042FA10
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00420220		0_2_00420220
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042D620		0_2_0042D620
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00423EC0		0_2_00423EC0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042FA10		0_2_0042FA10
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00406AD0		0_2_00406AD0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004196D0		0_2_004196D0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041F6E0		0_2_0041F6E0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041B6F0		0_2_0041B6F0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00418EF0		0_2_00418EF0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004262F0		0_2_004262F0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041AE80		0_2_0041AE80
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00418AB0		0_2_00418AB0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00421EB0		0_2_00421EB0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004226B0		0_2_004226B0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041BF50		0_2_0041BF50
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00415B60		0_2_00415B60
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00423B00		0_2_00423B00
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00429B10		0_2_00429B10
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00421730		0_2_00421730
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004183C0		0_2_004183C0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00417FC0		0_2_00417FC0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00427FC0		0_2_00427FC0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0041E3F0		0_2_0041E3F0

Contains functionality to call native functions

Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_004122A0 NtDelayExecution,		0_2_004122A0
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0042BE30 NtClose,		0_2_0042BE30

Sample file is different than original file name gathered from version info

Source: U57z89iyVo.exe, 00000000.00000002.610560386.00000000004A6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePropSchemasetip.exeX vs U57z89iyVo.exe
Source: U57z89iyVo.exe	Binary or memory string: OriginalFilenamePropSchemasetip.exeX vs U57z89iyVo.exe

Sample is known by Antivirus

Source: U57z89iyVo.exe	Virustotal: Detection: 52%
Source: U57z89iyVo.exe	Metadefender: Detection: 25%
Source: U57z89iyVo.exe	ReversingLabs: Detection: 77%

PE file has an executable .text section and no other executable section

Source: U57z89iyVo.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@1/2@0/3

Reads the hosts file

Source: C:\Users\user\Desktop\U57z89iyVo.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Unpacked PE file: 0.2.U57z89iyVo.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Unpacked PE file: 0.2.U57z89iyVo.exe.400000.0.unpack .text:ER;.rdata:R;.rdata2:W;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_007B5B50 push edx; ret		0_2_007B5CDE
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00777192 push dword ptr [ebp+ecx*8-49h]; retf		0_2_00777196
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_007962ED pushad ; iretd		0_2_00796305
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0078F6ED push esi; ret		0_2_0078F6F7
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_007789ED push 00000369h; ret		0_2_00778A48
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_007789BD push 00000369h; ret		0_2_00778A48
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_0079FB94 push esi; ret		0_2_0079FBAB
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00771D31 push FFFFFFD5h; ret		0_2_00771D38
Source: C:\Users\user\Desktop\U57z89iyVo.exe	Code function: 0_2_00770EAF push esi; ret		0_2_00770EB4

PE file contains sections with non-standard names

Source: U57z89iyVo.exe

Static PE information: section name: .rdata2

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -292000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -276000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -314000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -178000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -252000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -264000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -342000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -284000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -280000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -453000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -662000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -154000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -125000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -327000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -142000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -135000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -330000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -170000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -137000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -298000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -636000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -287000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -242000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -356000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -350000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -268000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -268000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -163000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -572000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -336000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -147000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -242000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -507000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -322000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -519000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -129000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -282000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -153000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -303000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -352000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -248000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -124000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -123000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -262000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -344000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -167000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -308000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -423000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -624000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -244000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -144000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -264000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -269000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -139000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -253000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -348000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -174000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -267000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -145000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -271000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -165000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -270000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -131000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -588000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\U57z89iyVo.exe TID: 7016	Thread sleep time: -168000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Last function: Thread delayed

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_007888FD rdtsc

0_2_007888FD

Contains functionality to query network adapater information

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW,

0_2_00405150

Contains functionality to query system information

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_00413930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_00413930

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_0042CEF8 FindFirstFileExW,

0_2_0042CEF8

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: U57z89iyVo.exe, 00000000.00000002.613665462.0000000000824000.00000004.00000020.sdmp, U57z89iyVo.exe, 00000000.00000002.611019614.00000000007CA000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_007888FD rdtsc

0_2_007888FD

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_00416C50 KiUserExceptionDispatcher,LdrLoadDll,

0_2_00416C50

Creates guard pages, often used to prevent reverse usering and debugging

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Memory protected: page execute read | page execute and read and write | page guard

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_00417A60 RtlAddVectoredExceptionHandler,

0_2_00417A60

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: U57z89iyVo.exe, 00000000.00000002.613973061.0000000000E50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: U57z89iyVo.exe, 00000000.00000002.613973061.0000000000E50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: U57z89iyVo.exe, 00000000.00000002.613973061.0000000000E50000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: U57z89iyVo.exe, 00000000.00000002.613973061.0000000000E50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the installation date of Windows

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\U57z89iyVo.exe

Code function: 0_2_00412980 GetUserNameW,

0_2_00412980