Source: 00000000.00000002.886303775.0000000003200000.00000040.00001000.00020000.00000000.sdmp |
Malware Configuration Extractor: GuLoader {"Payload URL": "http://www.fides-kenya.com/yem/wam.bin"} |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Virustotal: Detection: 8% |
Perma Link |
Source: SecuriteInfo.com.generic.ml.22865.exe |
ReversingLabs: Detection: 19% |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\spndingsfejlen |
Jump to behavior |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: MpCommu.pdb source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
Source: |
Binary string: MpCommu.pdbUGP source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405D74 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_0040699E FindFirstFileW,FindClose, |
0_2_0040699E |
Source: Malware configuration extractor |
URLs: http://www.fides-kenya.com/yem/wam.bin |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0 |
Source: network-server.png.0.dr |
String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/ |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd |
Source: SecuriteInfo.com.generic.ml.22865.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://ocsp.digicert.com0C |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://ocsp.digicert.com0N |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://ocsp.digicert.com0O |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, SourceCodePro-Black.otf.0.dr |
String found in binary or memory: http://scripts.sil.org/OFLSource |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://www.avast.com0/ |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: http://www.digicert.com/CPS0 |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, lang-1034.dll.0.dr |
String found in binary or memory: https://www.digicert.com/CPS0 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_00405809 |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: lang-1034.dll.0.dr |
Static PE information: No import functions for PE file found |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: HttpSigUpdate_BaseUrlhttps://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&https://go.microsoft.com/fwlink/?LinkID=870379&clcid=0x409&%lsarch=%ls&eng=%ls&avdelta=%ls&asdelta=%ls&prod=%ls&ostype=%u&signaturetype=%u&beta=%u&plat=%lsHttpSigUpdate_UrlSignatureTypeMiscellaneous ConfigurationBddUpdateFailureProductGUIDMpGradualuserReleaseMpuserPreventPlatformUpdateRunAsInvoker__COMPAT_LAYEROfflineTargetOS%ls\temp%ls\mpam-%x.exeFileDescriptionAntiMalware Definition UpdateMicrosoft Malware ProtectionProductNameUpdatePlatform.EXEOriginalFilename%lsMpService_NoLowPriUpdateHttpSigUpdate_StubTimeoutx86ia64armarm64 vs SecuriteInfo.com.generic.ml.22865.exe |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameMpCommu.dllj% vs SecuriteInfo.com.generic.ml.22865.exe |
Source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamefreetype.libD vs SecuriteInfo.com.generic.ml.22865.exe |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00406D5F |
0_2_00406D5F |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_732D1BFF |
0_2_732D1BFF |
Source: libpcre-1.dll.0.dr |
Static PE information: Number of sections : 11 > 10 |
Source: libfreetype-6.dll.0.dr |
Static PE information: Number of sections : 12 > 10 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Process Stats: CPU usage > 98% |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Virustotal: Detection: 8% |
Source: SecuriteInfo.com.generic.ml.22865.exe |
ReversingLabs: Detection: 19% |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File read: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Jump to behavior |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\nsm9E60.tmp |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File written: C:\Users\user\AppData\Local\Temp\analysekapitlet.ini |
Jump to behavior |
Source: classification engine |
Classification label: mal72.troj.evad.winEXE@1/15@0/0 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_004021AA CoCreateInstance, |
0_2_004021AA |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
0_2_00404AB5 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\spndingsfejlen |
Jump to behavior |
Source: SecuriteInfo.com.generic.ml.22865.exe |
Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Source: |
Binary string: MpCommu.pdb source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
Source: |
Binary string: MpCommu.pdbUGP source: SecuriteInfo.com.generic.ml.22865.exe, 00000000.00000002.885721867.000000000285C000.00000004.00000800.00020000.00000000.sdmp, MpCommu.dll.0.dr |
Source: Yara match |
File source: 00000000.00000002.886303775.0000000003200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_732D30C0 push eax; ret |
0_2_732D30EE |
Source: libpcre-1.dll.0.dr |
Static PE information: section name: .xdata |
Source: libfreetype-6.dll.0.dr |
Static PE information: section name: .xdata |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_732D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_732D1BFF |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\nsh9F2D.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\libpcre-1.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\lang-1034.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\libfreetype-6.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
File created: C:\Users\user\AppData\Local\Temp\MpCommu.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Registry key monitored for changes: HKEY_CURRENT_USER_Classes |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
RDTSC instruction interceptor: First address: 000000000321242B second address: 000000000321242B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F962CD168E6h 0x00000004 test ah, 0000007Bh 0x00000007 cmp ebx, ecx 0x00000009 jc 00007F962CD1686Fh 0x0000000b test dl, bl 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\libpcre-1.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lang-1034.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\libfreetype-6.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MpCommu.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405D74 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_0040699E FindFirstFileW,FindClose, |
0_2_0040699E |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_732D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_732D1BFF |
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.22865.exe |
Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_00403640 |