Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.AIDetectNet.01.5595.4189

Overview

General Information

Sample Name:	SecuriteInfo.com.W32.AIDetectNet.01.5595.4189 (renamed file extension from 4189 to exe)
Analysis ID:	659059
MD5:	8a743553a12d1c6cbf3bb3714410e034
SHA1:	7225b7233ad25d7b426cacee1df9ade262e67520
SHA256:	6e7ed6e2800cb45547906279f027fe098d08bb0dbc517ce41fe0ebe33222ab99
Tags:	AgentTeslaexe
Infos:

Detection

BluStealer, SpyEx

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Generic Dropper

Multi AV Scanner detection for submitted file

Yara detected SpyEx stealer

Malicious sample detected (through community Yara rule)

Yara detected BluStealer

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Tries to steal Crypto Currency Wallets

Writes or reads registry keys via WMI

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Encrypted powershell cmdline option found

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Stores files to the Windows start menu directory

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.AIDetectNet.01.5595.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe" MD5: 8A743553A12D1C6CBF3BB3714410E034)

powershell.exe (PID: 7036 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SecuriteInfo.com.W32.AIDetectNet.01.5595.exe (PID: 6312 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe MD5: 8A743553A12D1C6CBF3BB3714410E034)

SecuriteInfo.com.W32.AIDetectNet.01.5595.exe (PID: 4916 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe MD5: 8A743553A12D1C6CBF3BB3714410E034)

cleanup

Malware Configuration

Threatname: BluStealer

{"Exfil Mode": "SMTP", "From": "\"t.liaen@yandex.com\"", "To": "t.liaen@yandex.com", "SMTP Server": "lCC\u007f+wxN@|f\nBy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.704326968.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.704326968.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000000.00000003.444443907.0000000003926000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000003.490679051.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.490679051.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000008.00000000.500293865.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000000.500293865.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000000.00000002.503541674.0000000003909000.00000004.00000800.00020000.00000000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x1389c4:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000002.503541674.0000000003909000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.503541674.0000000003909000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000008.00000000.498743382.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000000.498743382.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000000.00000002.503255880.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.506443549.0000000004E70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.502969930.0000000002901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.503230604.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0xcbc4c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000000.00000002.503268704.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.503276267.0000000002B17000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000000.498134765.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000000.498134765.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
00000008.00000000.497568730.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000000.497568730.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 6952	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 6952	JoeSecurity_BluStealer	Yara detected BluStealer	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 6952	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 6952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 4916	JoeSecurity_BluStealer	Yara detected BluStealer	Joe Security
Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 4916	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3b56028.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3b56028.8.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39656d3.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.4e70000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.4e70000.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e1d80.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e1d80.4.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.10.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e56f3.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.6.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.4.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ba6048.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ba6048.9.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3bf0410.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3bf0410.7.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.8.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.6.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.8.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ba6048.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ba6048.9.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ae55b0.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.10.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.12.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.12.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e1d80.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e1d80.4.raw.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.12.unpack	JoeSecurity_SpyEx_1	Yara detected SpyEx stealer	Joe Security
Click to see the 34 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Virustotal: Detection: 40%			Perma Link
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	ReversingLabs: Detection: 43%

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe

Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe	Virustotal: Detection: 40%			Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe	ReversingLabs: Detection: 43%

Machine Learning detection for sample

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe

Joe Sandbox ML: detected

Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.13.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3b56028.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.450000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.6.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.4.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.450000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.11.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.9.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e1d80.4.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.8.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.7.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ba6048.9.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.10.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.12.unpack	Avira: Label: TR/Dropper.Gen
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.ce0000.5.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Source: 8.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.400000.0.raw.unpack

Malware Configuration Extractor: BluStealer {"Exfil Mode": "SMTP", "From": "\"t.liaen@yandex.com\"", "To": "t.liaen@yandex.com", "SMTP Server": "lCC\u007f+wxN@|f\nBy"}

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Work\SQLiteForExcel\Source\SQLite3_StdCall\Release\SQLite3_StdCall.pdb0. source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529484906.0000000003EFC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.705848358.000000001000B000.00000002.00000001.01000000.0000000B.sdmp, SQLite3_StdCall.dll.8.dr
Source:	Binary string: protobuf-net.pdbSHA256 source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Work\SQLiteForExcel\Source\SQLite3_StdCall\Release\SQLite3_StdCall.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529484906.0000000003EFC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.705848358.000000001000B000.00000002.00000001.01000000.0000000B.sdmp, SQLite3_StdCall.dll.8.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\Public\4334444639304441384146393044\SQLite3_StdCall.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\user\AppData\Local\Google\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File opened: C:\Users\Public\4334444639304441384146393044\SQLite3.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h

0_2_0280E8C8

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.502969930.0000000002901000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503255880.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503276267.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503268704.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.502969930.0000000002901000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.503541674.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

.NET source code contains very large array initializations

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, xtu.cs	Large array initialization: qii: array initializer size 708058
Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.450000.0.unpack, xtu.cs	Large array initialization: qii: array initializer size 708058
Source: 7.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.0.unpack, xtu.cs	Large array initialization: qii: array initializer size 708058
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.3.unpack, xtu.cs	Large array initialization: qii: array initializer size 708058

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.503541674.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02801219	0_2_02801219
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02801228	0_2_02801228
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02800F0B	0_2_02800F0B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02800F18	0_2_02800F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02882278	0_2_02882278
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02885BF0	0_2_02885BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02884840	0_2_02884840
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02881E58	0_2_02881E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02882670	0_2_02882670
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02885771	0_2_02885771
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02882269	0_2_02882269
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02885BE0	0_2_02885BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_028840B8	0_2_028840B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02880007	0_2_02880007
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02884831	0_2_02884831
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02882660	0_2_02882660
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02860968	0_2_02860968
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 0_2_02880040	0_2_02880040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_10008C5B	8_2_10008C5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_100096E3	8_2_100096E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_1000AB3C	8_2_1000AB3C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_1000919F	8_2_1000919F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_10009DDB	8_2_10009DDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_100041EB	8_2_100041EB

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Code function: String function: 00403202 appears 327 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Section loaded: zipfldr.dll

Jump to behavior

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: notes.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Virustotal: Detection: 40%
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	ReversingLabs: Detection: 43%

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Jump to behavior

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ajieobpm.51w.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/13@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.706002917.0000000060966000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.8.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_01

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.704326968.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: E*\AC:\Users\Dell\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Binary or memory string: I*\AC:\Users\Dell\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.490679051.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.505240066.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.704326968.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000000.500293865.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: `IF0@`I*\AC:\Users\Dell\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

String found in binary or memory: Addresses:GAddress for {0} count not be found./Address updated for {0}

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Work\SQLiteForExcel\Source\SQLite3_StdCall\Release\SQLite3_StdCall.pdb0. source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529484906.0000000003EFC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.705848358.000000001000B000.00000002.00000001.01000000.0000000B.sdmp, SQLite3_StdCall.dll.8.dr
Source:	Binary string: protobuf-net.pdbSHA256 source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Work\SQLiteForExcel\Source\SQLite3_StdCall\Release\SQLite3_StdCall.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529484906.0000000003EFC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.705848358.000000001000B000.00000002.00000001.01000000.0000000B.sdmp, SQLite3_StdCall.dll.8.dr

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39656d3.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.4e70000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.4e70000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.39e56f3.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.3ae55b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.444443907.0000000003926000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.503255880.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.506443549.0000000004E70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.502969930.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.503230604.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.503268704.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.503276267.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe PID: 6952, type: MEMORYSTR

.NET source code contains potential unpacker

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, xtu.cs	.Net Code: qij System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.450000.0.unpack, xtu.cs	.Net Code: qij System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.0.unpack, xtu.cs	.Net Code: qij System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.SecuriteInfo.com.W32.AIDetectNet.01.5595.exe.2f0000.3.unpack, xtu.cs	.Net Code: qij System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_0040B4E5 push esp; retf	8_2_0040B4EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_0040C23E push 0B88B6BFh; retf	8_2_0040C248
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Code function: 8_2_10002E11 push ecx; ret	8_2_10002E24

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Code function: 8_2_10006A98 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

8_2_10006A98

Source: initial sample	Static PE information: section name: .text entropy: 7.998461587691195
Source: initial sample	Static PE information: section name: .text entropy: 7.998461587691195

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\Public\4334444639304441384146393044\SQLite3_StdCall.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\Public\4334444639304441384146393044\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yajeu\notes.exe\:Zone.Identifier:$DATA	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sec

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.W32.AIDetectNet.01.5595.4189

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: BluStealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.445358931.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.501869229.0000000000502000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMT_68312.exeB vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.444916693.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.502969930.0000000002901000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506007712.0000000004D40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameYhezobkundwyvw.dll" vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503376807.0000000002B67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.506263882.0000000004E10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000002.503086371.0000000002984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameabacus.exe vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000000.00000003.491472337.0000000003C3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameabacus.exe vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000007.00000000.492565968.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMT_68312.exeB vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000000.500591295.0000000000497000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameabacus.exe vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000002.704326968.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameabacus.exe vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000000.496089277.0000000000D92000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMT_68312.exeB vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.525548641.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529653327.0000000003EE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529505154.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.525584977.0000000003EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529547803.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.525493096.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.525470221.0000000003EEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.525603775.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe, 00000008.00000003.529697322.0000000003EEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.5595.exe	Binary or memory string: OriginalFilenameMT_68312.exeB vs SecuriteInfo.com.W32.AIDetectNet.01.5595.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.AIDetectNet.01.5595.4189

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: BluStealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Windows Analysis Report
SecuriteInfo.com.W32.AIDetectNet.01.5595.4189