Source: 00000000.00000002.777573204.0000000003AA0000.00000040.00001000.00020000.00000000.sdmp |
Malware Configuration Extractor: GuLoader {"Payload URL": "http://finseb.com/qwer/COrg_ZBOJvB194.bin"} |
Source: PO#4200000866.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: PO#4200000866.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: D:\SourceCode\DevicePlugin\production_V4.2\Service\ServiceSDK\Release\DeviceServicePlugin\DeviceServicePlugin.pdb source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
Source: |
Binary string: D:\SourceCode\DevicePlugin\production_V4.2\Service\ServiceSDK\Release\DeviceServicePlugin\DeviceServicePlugin.pdb22 source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405D74 |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_0040699E FindFirstFileW,FindClose, |
0_2_0040699E |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: Malware configuration extractor |
URLs: http://finseb.com/qwer/COrg_ZBOJvB194.bin |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0 |
Source: PO#4200000866.exe |
String found in binary or memory: http://crl.certum.pl/ctnca.crl0k |
Source: PO#4200000866.exe |
String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l |
Source: PO#4200000866.exe |
String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl.globalsign.com/root.crl0G |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0 |
Source: PO#4200000866.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://ocsp.digicert.com0C |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://ocsp.digicert.com0O |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://ocsp.globalsign.com/rootr103 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://ocsp2.globalsign.com/rootr306 |
Source: PO#4200000866.exe |
String found in binary or memory: http://repository.certum.pl/ctnca.cer09 |
Source: PO#4200000866.exe |
String found in binary or memory: http://repository.certum.pl/ctnca2.cer09 |
Source: PO#4200000866.exe |
String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0 |
Source: PO#4200000866.exe |
String found in binary or memory: http://subca.ocsp-certum.com01 |
Source: PO#4200000866.exe |
String found in binary or memory: http://subca.ocsp-certum.com02 |
Source: PO#4200000866.exe |
String found in binary or memory: http://subca.ocsp-certum.com05 |
Source: PO#4200000866.exe |
String found in binary or memory: http://www.certum.pl/CPS0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: http://www.digicert.com/CPS0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, iso_3166.xml.0.dr |
String found in binary or memory: http://www.iso.org/iso/country_codes |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: https://www.asus.com/campaign/aura/global/download.php |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: https://www.digicert.com/CPS0 |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
String found in binary or memory: https://www.globalsign.com/repository/0 |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_00405809 |
Source: PO#4200000866.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameDeviceServicePlugin.dllL vs PO#4200000866.exe |
Source: PO#4200000866.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |
Source: PO#4200000866.exe |
Static PE information: invalid certificate |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Process Stats: CPU usage > 98% |
Source: PO#4200000866.exe |
Virustotal: Detection: 10% |
Source: PO#4200000866.exe |
Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |
Source: classification engine |
Classification label: mal76.troj.evad.winEXE@1/11@0/0 |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
0_2_00404AB5 |
Source: PO#4200000866.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: D:\SourceCode\DevicePlugin\production_V4.2\Service\ServiceSDK\Release\DeviceServicePlugin\DeviceServicePlugin.pdb source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
Source: |
Binary string: D:\SourceCode\DevicePlugin\production_V4.2\Service\ServiceSDK\Release\DeviceServicePlugin\DeviceServicePlugin.pdb22 source: PO#4200000866.exe, 00000000.00000002.777285149.0000000002773000.00000004.00000800.00020000.00000000.sdmp, DeviceServicePlugin.dll.0.dr |
Source: Yara match |
File source: 00000000.00000002.777573204.0000000003AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_72E51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_72E51BFF |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
File created: C:\Users\user\AppData\Local\Temp\library.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
File created: C:\Users\user\AppData\Local\Temp\nsn105D.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
File created: C:\Users\user\AppData\Local\Temp\DeviceServicePlugin.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
RDTSC instruction interceptor: First address: 0000000003AA29D1 second address: 0000000003AA29D1 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F0A1CC2A5F9h 0x00000006 inc ebp 0x00000007 push ss 0x00000008 pop ss 0x00000009 jmp 00007F0A1CC2A61Fh 0x0000000b inc ebx 0x0000000c rdtsc |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405D74 |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_0040699E FindFirstFileW,FindClose, |
0_2_0040699E |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_72E51BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_72E51BFF |
Source: C:\Users\user\Desktop\PO#4200000866.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |