flash

SecuriteInfo.com.Trojan.GenericKD.45754886.17334.exe

Status: finished
Submission Time: 23.02.2021 17:20:23
Malicious
Trojan
Evader
Miner
RedLine Xmrig

Comments

Tags

Details

  • Analysis ID:
    356837
  • API (Web) ID:
    615645
  • Analysis Started:
    23.02.2021 17:36:27
  • Analysis Finished:
    23.02.2021 17:48:48
  • MD5:
    bc584a3be92cfdfda79446372fffa46d
  • SHA1:
    6f7d11b7c795bd1f48a078f05d8a4c5600448a03
  • SHA256:
    8086d2b05316a9b44f55971a6c90da8ecb069d075973654f5f914229dc3070f6
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious
New

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
9/37

malicious
19/29

malicious

IPs

IP Country Detection
104.23.99.190
United States
88.99.66.31
Germany
195.2.84.91
Russian Federation
Click to see the 2 hidden entries
172.67.213.210
United States
88.99.193.240
Germany

Domains

Name IP Detection
api.ip.sb
0.0.0.0
ianawhois.vip.icann.org
192.0.47.59
blog.agencia10x.com
172.67.213.210
Click to see the 5 hidden entries
iplogger.org
88.99.66.31
WHOIS.RIPE.NET
193.0.6.135
pool.minexmr.com
88.99.193.240
pastebin.com
104.23.99.190
whois.iana.org
0.0.0.0

URLs

Name Detection
https://blog.agencia10x.com/mex.exe
https://blog.agencia10x.com/dance.exe
https://blog.agencia10x.com/dance.exed
Click to see the 23 hidden entries
http://ocsp.com
https://blog.agencia10x.com4
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
https://sectigo.com/CPS0D
https://pastebin.com4
https://pastebin.com/raw/bnxCb5RP
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://195.2.84.91/nvidia.zip
https://iplogger.org/1tsef7
https://blog.agencia10x.comD8
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
https://sectigo.com/CPS0
https://iplogger.org/1r2et7
http://ocsp.sectigo.com0
http://195.2.84.91/cpu.zip
http://ocsp.thawte.com0
https://pastebin.com/raw/bnxCb5RPChttps://pastebin.com/raw/WmBNYXYN
https://pastebin.com/raw/WmBNYXYN
https://iplogger.org
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
https://pastebin.comD8
http://195.2.84.91/amd.zip
http://crl.thawte.com/ThawteTimestampingCA.crl0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.GenericKD.45754886.17334.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\pg2bsuqa.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\zmql3v0y.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 6 hidden entries
C:\Users\user\AppData\Roaming\Windows\CPU\WinRing0x64.sys
PE32+ executable (native) x86-64, for MS Windows
#
C:\Users\user\AppData\Roaming\Windows\CPU\config.json
ASCII text
#
C:\Users\user\AppData\Roaming\Windows\CPU\cpu.exe
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\user\AppData\Roaming\Windows\RantimeBroker.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RantimeBroker.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Windows\cpu.zip
Zip archive data, at least v2.0 to extract
#