Windows Analysis Report
SecuriteInfo.com.Trojan.Inject.3564.exe

Antivirus detection for URL or domain

Source: Yara match	File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR

Source: 185.222.57.217

Avira URL Cloud: Label: malware

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: mshtml.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source:	Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source:	Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_0040290B FindFirstFileW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49748 -> 185.222.57.79:80
Source: Traffic	Snort IDS: 2829308 ETPRO TROJAN MSIL/Remcos Variant CnC Checkin 192.168.11.20:49749 -> 185.222.57.217:8780
Source: Traffic	Snort IDS: 2825929 ETPRO TROJAN MSIL/Remcos RAT CnC Checkin 192.168.11.20:49749 -> 185.222.57.217:8780
Source: Traffic	Snort IDS: 2825930 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Inbound) 185.222.57.217:8780 -> 192.168.11.20:49749
Source: Traffic	Snort IDS: 2825931 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Outbound) 192.168.11.20:49749 -> 185.222.57.217:8780

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin
Source: Malware configuration extractor	URLs: 185.222.57.217

Source: Joe Sandbox View	ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
Source: Joe Sandbox View	ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: global traffic

HTTP traffic detected: GET /SALES/1%20FEB%202-22_jalPPiWqFb130.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.11.20:49749 -> 185.222.57.217:8780

Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.57.79

Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.79/
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.79/SALES/1
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29959603610.0000000001868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.binY
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#Attribution
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#DerivativeWorks
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#Distribution
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#Notice
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#Reproduction
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	String found in binary or memory: http://creativecommons.org/ns#ShareAlike
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, MDDINGEN.exe.3.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048579911.0000000000626000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: global traffic

HTTP traffic detected: GET /SALES/1%20FEB%202-22_jalPPiWqFb130.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

E-Banking Fraud

Source: Yara match	File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_00406D5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_719D1BFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CCBB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CE1CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C533D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8F32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C6706
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C6772
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8B4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8757
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C67EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CEBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5224
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CEE3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CE632
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C6662
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C864B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C9A93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C86E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CAACE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C6936
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C890D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5552
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C51A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C69A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5587
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8595
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8593
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C85EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C55D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C503A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8808
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C501D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5478
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C88A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5CBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C508C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C6888
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C5094
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C50F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C54CF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CFF03 NtResumeThread,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CFA59 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CE1CD NtAllocateVirtualMemory,

Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameThrottlePlugin.dllL vs SecuriteInfo.com.Trojan.Inject.3564.exe

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Section loaded: edgegdi.dll

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

File created: C:\Users\user\AppData\Roaming\remcos

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

File created: C:\Users\user\AppData\Local\Temp\nsb8CF.tmp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/13@0/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_004021AA CoCreateInstance,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Mutant created: \Sessions\1\BaseNamedObjects\remcos_rurbibqnnhyclpl

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

File written: C:\Users\user\AppData\Local\Temp\HERMAPHRODEITY.ini

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Trojan.Inject.3564.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: mshtml.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source:	Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source:	Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000001.00000002.25193370365.00000000032C1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.25046406894.0000000001660000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_719D30C0 push eax; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C3A02 push ebp; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8F18 push 00000038h; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C974A push es; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C424A push dword ptr [esi-4Dh]; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C729B push ds; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C42EA push dword ptr [esi-4Dh]; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C4126 push dword ptr [esi-4Dh]; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C419B push dword ptr [esi-4Dh]; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C99D3 push edi; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C3C86 push ebp; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C40FD push dword ptr [esi-4Dh]; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C34C7 push ss; iretd

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_719D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File created: C:\Users\user\AppData\Local\Temp\nsw99C.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File created: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	File opened: C:\Program Files\qga\qga.exe

Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSHTML.DLL
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe TID: 7068	Thread sleep count: 3070 > 30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe TID: 7068	Thread sleep time: -30700000s >= -30000s

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_032C6424 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Window / User API: threadDelayed 3070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Window / User API: foregroundWindowGot 732

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_0040290B FindFirstFileW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_0040699E FindFirstFileW,FindClose,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	API call chain: ExitProcess graph end node

Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960096918.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29959850772.0000000001899000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960096918.00000000018CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWkKvA
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\syswow64\mshtml.dll

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_719D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_032C6424 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8B4C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CEBE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CB229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CEE3E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032CDE50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8D2A mov ebx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8D19 mov ebx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8D19 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8595 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8593 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C8CBE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Code function: 1_2_032C508C mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Code function: 1_2_032CC478 LdrInitializeThunk,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"

Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerer
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageranager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29984241513.000000001D52D000.00000004.00000010.00020000.00000000.sdmp, logs.dat.3.dr	Binary or memory string: [ Program Manager ]
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: art]Bpong\|cmd\|0\|cmd\|Program Manager\|cmd\|107\|cmd\|82453234
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|109\|cmd\|$+vx$+vx
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|121\|cmd\|87943281
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: art]Bpong\|cmd\|0\|cmd\|Program Manager\|cmd\|109\|cmd\|91603265C,,
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|109
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: art]Bpong\|cmd\|0\|cmd\|Program Manager\|cmd\|121\|cmd\|87943281C
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|107\|cmd\|82453234ember:Oct:October:Nov:November:Dec:DYY
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|109\|cmd\|91603265

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe

Stealing of Sensitive Information

Source: Yara match	File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	11 Input Capture	321 Security Software Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	22 Virtualization/Sandbox Evasion	LSASS Memory	22 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Side-Loading	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	111 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	4 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Inject.3564.exe	12%	Virustotal		Browse
SecuriteInfo.com.Trojan.Inject.3564.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw99C.tmp\System.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nsw99C.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.binY	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Virustotal		Browse
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://185.222.57.79/	2%	Virustotal		Browse
http://185.222.57.79/	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
185.222.57.217	100%	Avira URL Cloud	malware
http://185.222.57.79/SALES/1	0%	Avira URL Cloud	safe
http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
185.222.57.217	true	Avira URL Cloud: malware	unknown
http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.binY	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29959603610.0000000001868000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#DerivativeWorks	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://creativecommons.org/licenses/by-sa/4.0/	user-not-tracked-symbolic.svg.1.dr	false		high
http://creativecommons.org/ns#Distribution	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
http://185.222.57.79/	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#Attribution	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://185.222.57.79/SALES/1	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#ShareAlike	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.Trojan.Inject.3564.exe, MDDINGEN.exe.3.dr	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048579911.0000000000626000.00000008.00000001.01000000.00000005.sdmp	false		high
http://creativecommons.org/ns#Notice	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
http://creativecommons.org/ns#Reproduction	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high
http://www.gopher.ftp://ftp.	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#	SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.222.57.217	unknown	Netherlands		51447	ROOTLAYERNETNL	true
185.222.57.79	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635115
Start date and time: 27/05/202214:38:35	2022-05-27 14:38:35 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SecuriteInfo.com.Trojan.Inject.3564.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/13@0/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 21.9% (good quality ratio 21.5%) Quality average: 89% Quality standard deviation: 20.8%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 51.124.57.242
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, ctldl.windowsupdate.com, wdcp.microsoft.com, wd-prod-cp.trafficmanager.net, wd-prod-cp-eu-west-3-fe.westeurope.cloudapp.azure.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:40:50	API Interceptor	4379x Sleep call for process: SecuriteInfo.com.Trojan.Inject.3564.exe modified
14:40:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 C:\Users\user\AppData\Local\Temp\svulm\MDDINGEN.exe
14:41:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 C:\Users\user\AppData\Local\Temp\svulm\MDDINGEN.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	43
Entropy (8bit):	4.693479289485192
Encrypted:	false
SSDEEP:	3:JODb6MHIymy32ov:Jebozyn
MD5:	8B36E2227A5BD0472C64194B43581D90
SHA1:	E391FCABCE78C902A95B2B3A90F46380AA0E6031
SHA-256:	7A5D1B27408729909236B8B98CD3D19002750B7297981F32A6E6DD743B16BFB4
SHA-512:	FE426325981C65C37C16AE8021B2D8EDB50009743DC54C3EA2F496CA020BB980BCC43D70F5A2498A2AB8315183F5D2437DB72CCE69698978D927FA0E25DB1375
Malicious:	false
Reputation:	low
Preview:	[Vddelber60]..Paxilla=EKSKOMMUNIKATIONERS..

C:\Users\user\AppData\Local\Temp\GL-1.0.typelib

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.462849750105637
Encrypted:	false
SSDEEP:	24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
MD5:	5343C1A8B203C162A3BF3870D9F50FD4
SHA1:	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
SHA-256:	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
SHA-512:	E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

C:\Users\user\AppData\Local\Temp\HERMAPHRODEITY.ini

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.412814895472355
Encrypted:	false
SSDEEP:	3:bAL2Wlv3AhWuvU2:bu2gYEd2
MD5:	176F3A8631F14F0421935D07502B8CD9
SHA1:	70C91B54BDE9BA107AB322ECACF16C60E0D8E57B
SHA-256:	F507F6BB14F286DD6835A18FC9ECDB86F73DBA96E9E281D626718447F1C496BB
SHA-512:	CC963E6BD3577D12FAC185D3D61CCC72098C52E5F2E907E5724BA7BC9FF022A2E74D0DF18D82AD7EC645FEE9328458B7493B1BDD7F1216A677A42F8516568336
Malicious:	false
Reputation:	low
Preview:	[Godgrendes]..Resipiscence=Mightily197..

C:\Users\user\AppData\Local\Temp\Sydens.Pan7

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	data
Category:	dropped
Size (bytes):	133390
Entropy (8bit):	4.032963937138419
Encrypted:	false
SSDEEP:	768:8qWwx5hfUOSsrEMcRjmsUOvH0i7yx3CuhoP3tcD1stuSKjKNY1lDY491:84xrf+JJFvLuxyuhm3tcDqdCDZ91
MD5:	88518E49F5833B3DC505A5CA9E5A17EA
SHA1:	9C2EB3D3451DAE1531233D5D7B5323ED8F7D0E55
SHA-256:	DCC92754CBDB814A5AB672426B7072C7EC06D0B35CAC59DEB17E808019B38C1E
SHA-512:	76441315E4BA246AB527AE1D9E833C1F5A1EC019EBE4BDC46251E4B680CB8B62671574E09320148B3696F1C0580B1D3E6E62243EF04762D10142D5F45984C0E4
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380640
Entropy (8bit):	6.00755593352656
Encrypted:	false
SSDEEP:	6144:tqpZKqQPNb5tPcACMBdK99Uf2o7nypI83l4tHY1706ePrz2lxf:tqEvcA49Ro7R64Pi
MD5:	07B4E869E84B557512EE38A5C283FEF3
SHA1:	85AFD748ACB7DB97C763ABFEA292E8543B084517
SHA-256:	C718B6BF9A427A117FFC1AB1C0E02551AFB2675406BAC625534E02179DB12C9D
SHA-512:	C1E7E9781B538D6FD1265DF135606483DCC80B190FFB6DE6C9A7C4DD83B2B4453C746FE7C4E4AE577BE5DD40D4BB98BE8D0325119148D81D8D3CD094E92606E7
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........EK..+...+...+......+......+.......+.../...+...(...+.$....+...,...+...-...+......+......+.$.....+.$.+...+.$.....+.......+.$.)...+.Rich..+.........................PE..d...W6;a.........." .........2......$y....................................... .......P....`.........................................pK..T....K..0.......p........!......................T......................(......................h............................text...<........................... ..`.rdata.. ...........................@..@.data....%...........~..............@....pdata...!......."..................@..@.rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\applications-other.png

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	685
Entropy (8bit):	7.621282940093077
Encrypted:	false
SSDEEP:	12:6v/7U+KyobNKxqUPO9/qRw6l2ZK2zirFLDbFJXy+MAg+eElsD8itXaBdHjGGrOKF:N+KyobksUVRqK2+LX/zlsYR3HjGCbx
MD5:	8C4F73C63672801A4629BA32BFAF9E31
SHA1:	C59877FEA56A2D45E36389366B0CCBC0AC2B720B
SHA-256:	DFAFC0CCDCD4A2B74B8F74ECBE0BE82FC9FF3D055A8C9585DD78379DB7F01063
SHA-512:	E4479DFE6F342212DA86B0B4BE1095162F07F7AE98AC1921CC9ED7BB650E7024CF80D1A82EA99D3744C9127FA046E82C81D4D82D17152D868DD7D1D78ACE20E5
Malicious:	false
Preview:	.PNG........IHDR................a...tIDATx.....ki.G.....pm.........c.m.v.....uNr...O......"....\.B.......q.J......\|.^^^......g....6..^..NV(..../.wAIi.n.,,.....A~k....5....YwdS.........O/.s.9.k..\|v.d......<F.F......z.9 CDn.IzeS.^.w.).V.0.?.._.-.........p?......A.KV..}r...M......<..p......h.hEGg+.Z.$.jx7}LN....,....+...`..-N.6.8....T.T.r.zH.?...@.X...L......fgg..{...........EQq....n.G..{65<.cD)d>.c..V}r.>z.S.D"...[.p.M.4>\|.3\|..7..j8:.@..5.s.P...N..P..Vi8..<3.g.5...hO..-d..Z.,..........A.Yc..3.5\|.Nk.......I.7.*..a..x....2R......sn..0..2...o....Q.)<A..M......%`....P...Q.w. ..G.ggr.F..O5.`.5.(g...7......3l.-d..,..1F..[t.l9.g..FX........IEND.B`.

C:\Users\user\AppData\Local\Temp\folder-symbolic.symbolic.png

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.876785121167948
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllZMFnt4UoEw2GUqcklEj9h0XGqV/maXyj2fllljp:6v/lhPysLEnt4UoEwsqckGpq6jy/jp
MD5:	A008C1D205C5B08639C0A8D8673C6C72
SHA1:	5190570B97A6F75F1D10D3D1EC6E46AEC8705B0B
SHA-256:	54A3EBAD22462339574D87D835CA626E039E9B38A625806BAA051F80A327C428
SHA-512:	AC5F3ED7773C04223650B757F6168FA4F6C57BA4F0C073BD5AB933B96F0FC3AEE918543C4AEA703A9F472045C6FC5CEA012935850F2971A8107772B96F341AB5
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....]IDAT8.c`..8......>... F...4..u...IJ.....43B.......!..X.D.&rl.5...<...IPO......R..3...W......o2...M`....IEND.B`.

C:\Users\user\AppData\Local\Temp\nsw99C.tmp\System.dll

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rt64win7.inf

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	1292652
Entropy (8bit):	3.864768543104337
Encrypted:	false
SSDEEP:	3072:veHaqq95T1TpRKkYxyZuSkIRipOp1MbSqh43FFc23lRxSsopQfql1Ody29kn1jYF:XaekadZaJiaeQMV
MD5:	2D947C4C9147622CFC588FC5C17DDDEC
SHA1:	B367B48D1282E39E37B8992615FF9947DEE8CFED
SHA-256:	EBB8155AC71DD53258CE3772F189B4771272BA55E15A6DABDE2BEA6896DC2CC3
SHA-512:	3213B423153A1350AA3A0213079EDF21D77022C7839EB3A905F7EE8A02028E6A572499223889A55C2EF4646C0D3B2CB6DC64E1DCCEF26053EF80D34313EAD885
Malicious:	false
Preview:	..;. ... .C.O.P.Y.R.I.G.H.T. .(.C.). .2.0.0.7.-.2.0.1.3. .R.e.a.l.t.e.k. .C.O.R.P.O.R.A.T.I.O.N.....;.....;. .R.e.a.l.t.e.k. .P.C.I.e. .F.E. .F.a.m.i.l.y. .C.o.n.t.r.o.l.l.e.r.....;. .R.e.a.l.t.e.k. .P.C.I. .G.B.E. .F.a.m.i.l.y. .C.o.n.t.r.o.l.l.e.r.....;. .R.e.a.l.t.e.k. .P.C.I.e. .G.B.E. .F.a.m.i.l.y. .C.o.n.t.r.o.l.l.e.r.....;.........[.v.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e. . . .=. .".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s. . . . . . . .=. .N.e.t.....C.l.a.s.s.G.U.I.D. . . .=. .{.4.d.3.6.e.9.7.2.-.e.3.2.5.-.1.1.c.e.-.b.f.c.1.-.0.8.0.0.2.b.e.1.0.3.1.8.}.....P.r.o.v.i.d.e.r. . . . .=. .%.R.e.a.l.t.e.k.%.....D.r.i.v.e.r.V.e.r. . . .=. .0.4./.1.0./.2.0.1.3.,.7...0.7.2...0.4.1.0...2.0.1.3.....C.a.t.a.l.o.g.F.i.l.e...N.T. .=. .r.t.6.4.w.i.n.7...c.a.t.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.R.e.a.l.t.e.k.%.=.R.e.a.l.t.e.k.,. .N.T.a.m.d.6.4.........[.C.o.n.t.r.o.l.F.l.a.g.s.].....E.x.c.l.u.d.e.F.r.o.m.S.e.l.e.c.t. . . . . .=. .*.............[.R.e.a.l.t.e.k...N.T.a.m.d.6.4.].....;. .8.

C:\Users\user\AppData\Local\Temp\svulm\MDDINGEN.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	data
Category:	dropped
Size (bytes):	658027
Entropy (8bit):	6.79371907132509
Encrypted:	false
SSDEEP:	12288:rYgT387AbTc/v4b0h2gdYBXnQLGT/Fp0hZAvcG0ePzNSd01RHqtZCCNfn6THbMcy:rYgo7AbTc/v4b0h2gqBXnQLGT/Fp0hZB
MD5:	D2DD4E8168706A8AE302E5F59D7BB993
SHA1:	DF22F35E6C42E7717D821387DA387093D6ED4E12
SHA-256:	0AB4A5721960B4959FFAC1451C15EE114E5C45905A8DA1E5AEA28C3F506CC9FB
SHA-512:	EB7CB3B76859CAB2F633E231449387F414DEF3F950DCCDAB5D5C97EE60F1319EB14F3B772D5DF8431D125BE70F84F179E8299A7F785A65EDD4A9AEF1E20F925D
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@..........................`............@.......................................... ..8=...........................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...p...............................rsrc...8=... ...>..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\user-not-tracked-symbolic.svg

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	4.970880293743837
Encrypted:	false
SSDEEP:	96:VkoIankPYfLoIJomlXTlUxSHtuubQLqJlm0mxmOmTGmVm/mYmY:VkfcMI64RfIubQW/BEjPoKlp
MD5:	8F7C767AFA41E6D03BDE59296DFF8175
SHA1:	EEFA541D3A06CAFEB62A535B86D1A95D6AAE1CD6
SHA-256:	292770B23ED69AF4EDE9255BB66ADF3D3A0FF62D827D2BA05ED2C44A57228ED6
SHA-512:	FFE75CCD2EFFA74E24955BF36DBD86BB1B30F880D233D8F5C5431E99169224E89E7C59FDD052C6F9544E05CF11FD425F01ADD6E87B512C318132D963CB338B04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". width="16". version="1.1". style="enable-background:new". id="svg7384". height="16.000645">. <metadata. id="metadata90">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />. <dc:title>Gnome Symbolic Icons</dc:title>. <cc:license. rdf:resource="http://creativecommons.org/licenses/by-sa/4.0/" />. </cc:Work>. <cc:License. rdf:about="http://creativecommons.org/licenses/by-sa/4.0/">. <cc:permits. rdf:resource="http://creativecommons.org/ns#Reproduction" />. <cc:permits. rdf:resource="htt

C:\Users\user\AppData\Local\Temp\video-joined-displays-symbolic.symbolic.png

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	208
Entropy (8bit):	6.572781220141588
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBllUxPFp/7l04sR5/7dY+MK6Ie+ed0oxIwsoazRC4I:6v/lhPysIzlZsfdY+MKda8RC4KymCeVp
MD5:	E2FC23D36F5488D1F2888D524F933582
SHA1:	335CA8F69FF42E4418F0C95A9626F7B027F62139
SHA-256:	07AEFFEAC02CD1501C54E5D66ED1816B83AF04E51B1676AF3C4A538FDC9E9E4A
SHA-512:	EA3B15A24F8B3FF83DE6ABB7392A0672A55F1F87DDC485B2AD517E76B48358C852484CF2D23FD7989992676AF73640D6CC2002FD2F0FD2EAA29C39C7DFE503BA
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8..1.. .E..@v....P...........8.O.......w4@.8`..I.I....0...&y..../9..r....5..@....P.+..l..*..8..~...@....p...y.#0)....o...fq....>....S.^&.n....IEND.B`.

C:\Users\user\AppData\Roaming\remcos\logs.dat