Source: 00000000.00000002.1182087160.00000000027F0000.00000040.00000800.00020000.00000000.sdmp |
Malware Configuration Extractor: GuLoader {"Payload URL": "https://www.konutmarket.com/2022file_iz"} |
Source: 9TpV4rfMmJ.exe |
ReversingLabs: Detection: 25% |
Source: 9TpV4rfMmJ.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: 9TpV4rfMmJ.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: secur32.pdb source: secur32.dll.0.dr |
Source: |
Binary string: SxsStore.pdb source: sxsstore.dll.0.dr |
Source: |
Binary string: secur32.pdbUGP source: secur32.dll.0.dr |
Source: |
Binary string: SxsStore.pdbGCTL source: sxsstore.dll.0.dr |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C49 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_00406873 FindFirstFileW,FindClose, |
0_2_00406873 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: Malware configuration extractor |
URLs: https://www.konutmarket.com/2022file_iz |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0 |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02 |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0 |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://ocsp.digicert.com0C |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://ocsp.digicert.com0O |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: http://www.digicert.com/CPS0 |
Source: 9TpV4rfMmJ.exe |
String found in binary or memory: https://www.digicert.com/CPS0 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_004056DE |
Source: 9TpV4rfMmJ.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: 9TpV4rfMmJ.exe, 00000000.00000002.1181768585.000000000040A000.00000004.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameSxsStore.dllj% vs 9TpV4rfMmJ.exe |
Source: 9TpV4rfMmJ.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: 9TpV4rfMmJ.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: 9TpV4rfMmJ.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_0040352D |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040755C |
0_2_0040755C |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_00406D85 |
0_2_00406D85 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_6FC51BFF |
0_2_6FC51BFF |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9C2E |
0_2_027F9C2E |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9462 |
0_2_027F9462 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027FDAF1 |
0_2_027FDAF1 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F8AD9 |
0_2_027F8AD9 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9963 |
0_2_027F9963 |
Source: 9TpV4rfMmJ.exe |
Static PE information: invalid certificate |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9C2E NtAllocateVirtualMemory, |
0_2_027F9C2E |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Process Stats: CPU usage > 98% |
Source: 9TpV4rfMmJ.exe |
ReversingLabs: Detection: 25% |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File read: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Jump to behavior |
Source: 9TpV4rfMmJ.exe |
Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Jump to behavior |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_0040352D |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File created: C:\Users\user\AppData\Local\Temp\nsh3327.tmp |
Jump to behavior |
Source: classification engine |
Classification label: mal68.troj.winEXE@1/4@0/0 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_004021AA CoCreateInstance, |
0_2_004021AA |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
0_2_0040498A |
Source: 9TpV4rfMmJ.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: secur32.pdb source: secur32.dll.0.dr |
Source: |
Binary string: SxsStore.pdb source: sxsstore.dll.0.dr |
Source: |
Binary string: secur32.pdbUGP source: secur32.dll.0.dr |
Source: |
Binary string: SxsStore.pdbGCTL source: sxsstore.dll.0.dr |
Source: Yara match |
File source: 00000000.00000002.1182087160.00000000027F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_6FC530C0 push eax; ret |
0_2_6FC530EE |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F2C74 push edx; retf |
0_2_027F2CCC |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F6C4F push 910F868Eh; ret |
0_2_027F6C30 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F2C14 push edx; retf |
0_2_027F2CCC |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F3CD9 push CACC293Ch; retf |
0_2_027F3CE4 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F4ECB push eax; iretd |
0_2_027F4ECC |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F50CB push esi; retf |
0_2_027F50CC |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F5EB5 push D0CC293Ch; retf |
0_2_027F5EC0 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F2C99 push edx; retf |
0_2_027F2CCC |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F1B54 push FFFFFF81h; ret |
0_2_027F1B58 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F594F pushfd ; retf |
0_2_027F5981 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F1F2D push edx; retf |
0_2_027F1F51 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F1F27 push 00000027h; iretd |
0_2_027F1F29 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F111B push esi; ret |
0_2_027F111C |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F5919 pushfd ; retf |
0_2_027F5981 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F49EF pushad ; iretd |
0_2_027F4A06 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F6BD2 push 910F868Eh; ret |
0_2_027F6C30 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F6BA9 push 910F868Eh; ret |
0_2_027F6C30 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F59A1 pushfd ; retf |
0_2_027F5981 |
Source: secur32.dll.0.dr |
Static PE information: section name: .didat |
Source: secur32.dll.0.dr |
Static PE information: 0xAEC0B68B [Mon Nov 27 15:00:27 2062 UTC] |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_6FC51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6FC51BFF |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File created: C:\Users\user\AppData\Local\Temp\nsd3616.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File created: C:\Users\user\AppData\Local\Temp\secur32.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
File created: C:\Users\user\AppData\Local\Temp\sxsstore.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\secur32.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sxsstore.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9366 rdtsc |
0_2_027F9366 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C49 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_00406873 FindFirstFileW,FindClose, |
0_2_00406873 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027FDAF1 mov eax, dword ptr fs:[00000030h] |
0_2_027FDAF1 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027FCAD3 mov eax, dword ptr fs:[00000030h] |
0_2_027FCAD3 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9128 mov eax, dword ptr fs:[00000030h] |
0_2_027F9128 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027FC501 mov eax, dword ptr fs:[00000030h] |
0_2_027FC501 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_6FC51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6FC51BFF |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027F9366 rdtsc |
0_2_027F9366 |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_027FEF3F RtlAddVectoredExceptionHandler, |
0_2_027FEF3F |
Source: C:\Users\user\Desktop\9TpV4rfMmJ.exe |
Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_0040352D |