Windows Analysis Report
SecuriteInfo.com.generic.ml.10062.exe

Overview

General Information

Sample Name: SecuriteInfo.com.generic.ml.10062.exe
Analysis ID: 634320
MD5: 95050a1e0c7d4c57f62e26967b3b0bfd
SHA1: baa57d1bf6d8a41ba89c6d09bfc4ec2bc986830c
SHA256: 458597ef6835136826411179f244673d5b2702e906bedb3e470786eb455d98ce
Infos:

Detection

AgentTesla, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected GuLoader
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
C2 URLs / IPs found in malware configuration
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
PE / OLE file has an invalid certificate
PE file contains more sections than normal
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000001.00000002.62482366099.00000000032B0000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "http://2.56.57.22/yendexoriginwithoutfilter_rtSDhNF87.bin"}
Source: SecuriteInfo.com.generic.ml.10062.exe.7996.1.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "droidyandex@centraldefiltros.clicui4cu2@@mail.centraldefiltros.cldroidyandexreports@centraldefiltros.cl"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.generic.ml.10062.exe Virustotal: Detection: 11% Perma Link
Uses 32bit PE files
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: H:\n2\3rdparty\FFmpeg\2.8.2\public\src\ffmpeg\libavutil\avutil-54.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, System.IO.FileSystem.Watcher.dll.1.dr
Source: Binary string: D:\SourceCode\gc3.gpuswitch\production_V4.2\Service\ServiceSDK\Release\GPUSwitchPlugin\ARMOURY CRATE eGPU Product.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr
Source: Binary string: D:\SourceCode\gc3.gpuswitch\production_V4.2\Service\ServiceSDK\Release\GPUSwitchPlugin\ARMOURY CRATE eGPU Product.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr
Source: Binary string: H:\n2\3rdparty\FFmpeg\2.8.2\public\src\ffmpeg\libavutil\avutil-54.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.Watcher\net6.0-windows-Release\System.IO.FileSystem.Watcher.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, System.IO.FileSystem.Watcher.dll.1.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49763 -> 2.56.57.22:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://2.56.57.22/yendexoriginwithoutfilter_rtSDhNF87.bin
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GBTCLOUDUS GBTCLOUDUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /yendexoriginwithoutfilter_rtSDhNF87.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 2.56.57.22Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: unknown TCP traffic detected without corresponding DNS query: 2.56.57.22
Source: CasPol.exe, 00000005.00000002.67212907111.000000001D58F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C
Source: CasPol.exe, 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000005.00000003.63392768852.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67188771993.00000000011C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://2.56.57.22/yendexoriginwithoutfilter_rtSDhNF87.bin
Source: CasPol.exe, 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: folder-publicshare.png.1.dr String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CasPol.exe, 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mglNPC.com
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://s2.symcb.com0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://subca.ocsp-certum.com01
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://subca.ocsp-certum.com02
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://subca.ocsp-certum.com05
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://sv.symcd.com0&
Source: avutil-54.dll.1.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr String found in binary or memory: http://www.avast.com0/
Source: SecuriteInfo.com.generic.ml.10062.exe String found in binary or memory: http://www.certum.pl/CPS0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://www.nero.com
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://www.symauth.com/cps0(
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: http://www.symauth.com/rpa00
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, System.IO.FileSystem.Watcher.dll.1.dr String found in binary or memory: https://github.com/dotnet/runtime
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, lang-1045.dll.1.dr, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: CasPol.exe, 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: global traffic HTTP traffic detected: GET /yendexoriginwithoutfilter_rtSDhNF87.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 2.56.57.22Cache-Control: no-cache
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00405809

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 4028, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Uses 32bit PE files
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: CasPol.exe PID: 4028, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00406D5F 1_2_00406D5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_6F671BFF 1_2_6F671BFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C1E19 1_2_032C1E19
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C09E6 1_2_032C09E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA722 1_2_032BA722
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1727 1_2_032B1727
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0338 1_2_032B0338
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0734 1_2_032B0734
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0B0C 1_2_032B0B0C
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1B19 1_2_032B1B19
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B176C 1_2_032B176C
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0379 1_2_032B0379
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B077D 1_2_032B077D
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0B4A 1_2_032B0B4A
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1755 1_2_032B1755
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B03A9 1_2_032B03A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B17A3 1_2_032B17A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7BA6 1_2_032B7BA6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA7A6 1_2_032BA7A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C17BF 1_2_032C17BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7BB3 1_2_032B7BB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0B89 1_2_032B0B89
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA78F 1_2_032BA78F
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B438E 1_2_032B438E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B17E5 1_2_032B17E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA7FE 1_2_032BA7FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0BC1 1_2_032B0BC1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B07C0 1_2_032B07C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B03DE 1_2_032B03DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0225 1_2_032B0225
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0609 1_2_032B0609
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B6A05 1_2_032B6A05
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7E1A 1_2_032B7E1A
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0A66 1_2_032B0A66
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0648 1_2_032B0648
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA642 1_2_032BA642
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0E40 1_2_032B0E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0A45 1_2_032B0A45
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0255 1_2_032B0255
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C2AAC 1_2_032C2AAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA6B9 1_2_032BA6B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B06BC 1_2_032B06BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B02B3 1_2_032B02B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C46B0 1_2_032C46B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0683 1_2_032B0683
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0E82 1_2_032B0E82
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0281 1_2_032B0281
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0687 1_2_032B0687
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0A9E 1_2_032B0A9E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1AEA 1_2_032B1AEA
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C22E4 1_2_032C22E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B02FE 1_2_032B02FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B06F6 1_2_032B06F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0ADD 1_2_032B0ADD
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BB12B 1_2_032BB12B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7139 1_2_032B7139
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA538 1_2_032BA538
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C2539 1_2_032C2539
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0930 1_2_032B0930
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0D34 1_2_032B0D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0505 1_2_032B0505
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1917 1_2_032B1917
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B056B 1_2_032B056B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B016F 1_2_032B016F
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA567 1_2_032BA567
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B6D72 1_2_032B6D72
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0976 1_2_032B0976
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BB148 1_2_032BB148
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1943 1_2_032B1943
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0DAD 1_2_032B0DAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B19B9 1_2_032B19B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B01B0 1_2_032B01B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B09B7 1_2_032B09B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7D8C 1_2_032B7D8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1980 1_2_032B1980
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0586 1_2_032B0586
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA59E 1_2_032BA59E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B01E4 1_2_032B01E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B09FA 1_2_032B09FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B69FF 1_2_032B69FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0DF6 1_2_032B0DF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1DCC 1_2_032B1DCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B05D2 1_2_032B05D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B040E 1_2_032B040E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B000E 1_2_032B000E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0802 1_2_032B0802
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0C68 1_2_032B0C68
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0C6E 1_2_032B0C6E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0C64 1_2_032B0C64
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7C48 1_2_032B7C48
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B044F 1_2_032B044F
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0C42 1_2_032B0C42
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0840 1_2_032B0840
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B005B 1_2_032B005B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B185C 1_2_032B185C
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0CA9 1_2_032B0CA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0887 1_2_032B0887
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0485 1_2_032B0485
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B189B 1_2_032B189B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0095 1_2_032B0095
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B7CE8 1_2_032B7CE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B6CEC 1_2_032B6CEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA4F9 1_2_032BA4F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B0CF4 1_2_032B0CF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B18CE 1_2_032B18CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B00CE 1_2_032B00CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B08C0 1_2_032B08C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B04C6 1_2_032B04C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B6CDF 1_2_032B6CDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013478D0 5_2_013478D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01347E56 5_2_01347E56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134D680 5_2_0134D680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01345128 5_2_01345128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01343179 5_2_01343179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013425E8 5_2_013425E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134D058 5_2_0134D058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01346310 5_2_01346310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01345B80 5_2_01345B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134EA70 5_2_0134EA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A8430 5_2_013A8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A5888 5_2_013A5888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A7B06 5_2_013A7B06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A9F70 5_2_013A9F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013ADF60 5_2_013ADF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A93D9 5_2_013A93D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A07D2 5_2_013A07D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A5E08 5_2_013A5E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013AAA60 5_2_013AAA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A9AB0 5_2_013A9AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A4540 5_2_013A4540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_013A4190 5_2_013A4190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C6214E8 5_2_1C6214E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C62D518 5_2_1C62D518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C6272D8 5_2_1C6272D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D325D08 5_2_1D325D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D324374 5_2_1D324374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D325C20 5_2_1D325C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D3269D0 5_2_1D3269D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F714320 5_2_1F714320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F71BE70 5_2_1F71BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F71B110 5_2_1F71B110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F71DC78 5_2_1F71DC78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F718C68 5_2_1F718C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F713708 5_2_1F713708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1F713A50 5_2_1F713A50
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C1E19 NtAllocateVirtualMemory, 1_2_032C1E19
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C41B7 NtResumeThread, 1_2_032C41B7
PE file does not import any functions
Source: System.IO.FileSystem.Watcher.dll.1.dr Static PE information: No import functions for PE file found
Source: MsMpLics.dll.1.dr Static PE information: No import functions for PE file found
Source: lang-1045.dll.1.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameARMOURY CRATE eGPU Product.exe8 vs SecuriteInfo.com.generic.ml.10062.exe
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.generic.ml.10062.exe
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSystem.IO.FileSystem.Watcher.dll@ vs SecuriteInfo.com.generic.ml.10062.exe
PE file contains strange resources
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
PE / OLE file has an invalid certificate
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: invalid certificate
PE file contains more sections than normal
Source: p11-kit-trust.dll.1.dr Static PE information: Number of sections : 11 > 10
Source: SecuriteInfo.com.generic.ml.10062.exe Virustotal: Detection: 11%
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Jump to behavior
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\nsv213.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@8/14@0/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_004021AA CoCreateInstance, 1_2_004021AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_00404AB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1264:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1264:304:WilStaging_02
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File written: C:\Users\user\AppData\Local\Temp\krista.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SecuriteInfo.com.generic.ml.10062.exe Static file information: File size 1447056 > 1048576
Source: SecuriteInfo.com.generic.ml.10062.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: H:\n2\3rdparty\FFmpeg\2.8.2\public\src\ffmpeg\libavutil\avutil-54.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr
Source: Binary string: System.IO.FileSystem.Watcher.ni.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, System.IO.FileSystem.Watcher.dll.1.dr
Source: Binary string: D:\SourceCode\gc3.gpuswitch\production_V4.2\Service\ServiceSDK\Release\GPUSwitchPlugin\ARMOURY CRATE eGPU Product.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr
Source: Binary string: D:\SourceCode\gc3.gpuswitch\production_V4.2\Service\ServiceSDK\Release\GPUSwitchPlugin\ARMOURY CRATE eGPU Product.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, ARMOURY CRATE eGPU Product.exe.1.dr
Source: Binary string: H:\n2\3rdparty\FFmpeg\2.8.2\public\src\ffmpeg\libavutil\avutil-54.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62481419345.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, avutil-54.dll.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.FileSystem.Watcher\net6.0-windows-Release\System.IO.FileSystem.Watcher.pdb source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62478493581.000000000293F000.00000004.00000800.00020000.00000000.sdmp, System.IO.FileSystem.Watcher.dll.1.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.62482366099.00000000032B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.62332198808.0000000000F00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_6F6730C0 push eax; ret 1_2_6F6730EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BC74F push 3A3A3F63h; retf 1_2_032BC76A
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B8E23 pushad ; iretd 1_2_032B8E2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B5AC9 push FFFFFF86h; iretd 1_2_032B5ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B9AD4 push esp; retf 1_2_032B9AD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BC9C2 push ebp; iretd 1_2_032BC9C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134142F push edi; retn 0000h 5_2_01341431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC2A pushad ; ret 5_2_0134CC55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC06 pushad ; ret 5_2_0134CC0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC56 pushad ; ret 5_2_0134CC59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC96 pushad ; ret 5_2_0134CC9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC9E pushad ; ret 5_2_0134CCA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC83 pushad ; ret 5_2_0134CC8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CC8E pushad ; ret 5_2_0134CC95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCE6 pushad ; ret 5_2_0134CCE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCE2 pushad ; ret 5_2_0134CCE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCEE pushad ; ret 5_2_0134CCF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCEA pushad ; ret 5_2_0134CCED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCDE pushad ; ret 5_2_0134CCE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCDA pushad ; ret 5_2_0134CCDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CCCF pushad ; ret 5_2_0134CCD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB26 pushad ; ret 5_2_0134CB29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB16 push ss; ret 5_2_0134CB19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB12 push ss; ret 5_2_0134CB15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB1A pushad ; ret 5_2_0134CB25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB6E pushad ; ret 5_2_0134CB75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CB46 push ss; ret 5_2_0134CB5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CBB2 pushad ; ret 5_2_0134CBBD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CBBE pushad ; ret 5_2_0134CBC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CBAE push ss; ret 5_2_0134CBB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134CBAA push ss; ret 5_2_0134CBAD
PE file contains sections with non-standard names
Source: p11-kit-trust.dll.1.dr Static PE information: section name: .xdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_6F671BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_6F671BFF
Binary contains a suspicious time stamp
Source: MsMpLics.dll.1.dr Static PE information: 0xE6DA2BE7 [Wed Sep 24 01:22:47 2092 UTC]
Source: initial sample Static PE information: section name: .text entropy: 6.94282730477
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\nsi821.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\System.IO.FileSystem.Watcher.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\avutil-54.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\lang-1045.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\p11-kit-trust.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\MsMpLics.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File created: C:\Users\user\AppData\Local\Temp\ARMOURY CRATE eGPU Product.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62482616857.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62482616857.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4232 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\System.IO.FileSystem.Watcher.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\avutil-54.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lang-1045.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\p11-kit-trust.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MsMpLics.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ARMOURY CRATE eGPU Product.exe Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1F29 rdtsc 1_2_032B1F29
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9940 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe API call chain: ExitProcess graph end node
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62482616857.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: avutil-54.dll.1.dr Binary or memory string: yuv420pyuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgraygray8,y8monowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbrgbaabgrbgragray16bey16begray16ley16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444beya8gray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10leyuv422p9beyuv422p9levda_vldgbrpgbrp9begbrp9legbrp10begbrp10legbrp16begbrp16leyuva420p9beyuva420p9leyuva422p9beyuva422p9leyuva444p9beyuva444p9leyuva420p10beyuva420p10leyuva422p10beyuva422p10leyuva444p10beyuva444p10leyuva420p16beyuva420p16leyuva422p16beyuva422p16leyuva444p16beyuva444p16levdpauxyz12lexyz12benv16nv20lenv20beyvyu422vdaya16beya16leqsvmmald3d11va_vldrgba64bergba64lebgra64bebgra64le0rgbrgb00bgrbgr0yuva444pyuva422pyuv420p12beyuv420p12leyuv420p14beyuv420p14leyuv422p12beyuv422p12leyuv422p14beyuv422p14leyuv444p12beyuv444p12leyuv444p14beyuv444p14legbrp12begbrp12legbrp14begbrp14legbrapgbrap16begbrap16leyuvj411pbayer_bggr8bayer_rggb8bayer_gbrg8bayer_grbg8bayer_bggr16lebayer_bggr16bebayer_rggb16lebayer_rggb16bebayer_gbrg16lebayer_gbrg16bebayer_grbg16lebayer_grbg16beyuv440p10leyuv440p10beyuv440p12leyuv440p12beayuv64leayuv64bevideotoolbox_vldunknowntvpcreservedbt470mbt2020linearlog100log316iec61966-2-4bt1361eiec61966-2-1bt2020-10bt2020-20gbrycgcobt2020ncbt2020cunspecifiedleftcentertoplefttopbottomleftbottomrgb32bgr32le%s%sname nb_components nb_bits%-11s %7d %10dlibavutil/pixdesc.cd->log2_chroma_w <= 3d->log2_chroma_h <= 3d->nb_components <= 4d->name && d->name[0](d->nb_components==4 || d->nb_components==2) == !!(d->flags & (1 << 7))!c->plane && !c->step_minus1 && !c->offset_plus1 && !c->shift && !c->depth_minus1c->step_minus1 >= c->depth_minus18*(c->step_minus1+1) >= c->depth_minus1+1bayer_tmp[0] == 0 && tmp[1] == 0beyuvjpixelutils support is required but libavutil is not compiled with it
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: avutil-54.dll.1.dr Binary or memory string: xvmcidct
Source: CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: CasPol.exe, 00000005.00000003.63392916195.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67188286070.000000000117B000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67188909794.00000000011DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62482616857.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: CasPol.exe, 00000005.00000003.63392916195.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67188909794.00000000011DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%k,
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: SecuriteInfo.com.generic.ml.10062.exe, 00000001.00000002.62483095871.0000000004F19000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 00000005.00000002.67190695311.0000000002D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_6F671BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_6F671BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B1F29 rdtsc 1_2_032B1F29
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C121E mov eax, dword ptr fs:[00000030h] 1_2_032C121E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032C1954 mov eax, dword ptr fs:[00000030h] 1_2_032C1954
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032BA4F9 mov eax, dword ptr fs:[00000030h] 1_2_032BA4F9
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0134F328 LdrInitializeThunk, 5_2_0134F328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F00000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_032B78D6 cpuid 1_2_032B78D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.10062.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4028, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4028, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.67212135583.000000001D4E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4028, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 634320 Sample: SecuriteInfo.com.generic.ml... Startdate: 25/05/2022 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic 2->31 33 Found malware configuration 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 5 other signatures 2->37 7 SecuriteInfo.com.generic.ml.10062.exe 6 35 2->7         started        process3 file4 21 C:\Users\user\AppData\...\p11-kit-trust.dll, PE32+ 7->21 dropped 23 C:\Users\user\AppData\Local\...\System.dll, PE32 7->23 dropped 25 C:\Users\user\AppData\Local\...\lang-1045.dll, PE32 7->25 dropped 27 4 other files (none is malicious) 7->27 dropped 39 Writes to foreign memory regions 7->39 41 Tries to detect Any.run 7->41 11 CasPol.exe 11 7->11         started        15 CasPol.exe 7->15         started        17 CasPol.exe 7->17         started        signatures5 process6 dnsIp7 29 2.56.57.22, 49763, 80 GBTCLOUDUS Netherlands 11->29 43 Tries to steal Mail credentials (via file / registry access) 11->43 45 Tries to harvest and steal browser information (history, passwords, etc) 11->45 47 Tries to detect Any.run 11->47 19 conhost.exe 11->19         started        49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->51 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
2.56.57.22
 unknown Netherlands
395800 GBTCLOUDUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://2.56.57.22/yendexoriginwithoutfilter_rtSDhNF87.bin true
  • Avira URL Cloud: safe
 unknown