Source: xKBLVUHoY6.exe |
Virustotal: Detection: 36% |
Perma Link |
Source: http://212.193.0.40/redi_oXifXcNSpB69.bin |
Avira URL Cloud: Label: malware |
Source: http://212.193.0.40/redi_oXifXcNSpB69.bin |
Virustotal: Detection: 15% |
Perma Link |
Source: 00000000.00000002.753579119.00000000031B0000.00000040.00001000.00020000.00000000.sdmp |
Malware Configuration Extractor: GuLoader {"Payload URL": "http://212.193.0.40/redi_oXifXcNSpB69.bin"} |
Source: xKBLVUHoY6.exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: xKBLVUHoY6.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C13 |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_0040683D FindFirstFileW,FindClose, |
0_2_0040683D |
Source: Malware configuration extractor |
URLs: http://212.193.0.40/redi_oXifXcNSpB69.bin |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0 |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0 |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://ocsp.digicert.com0A |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://ocsp.digicert.com0C |
Source: xKBLVUHoY6.exe |
String found in binary or memory: http://ocsp.digicert.com0X |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_004056A8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_004056A8 |
Source: xKBLVUHoY6.exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: xKBLVUHoY6.exe |
Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034F7 |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File created: C:\Windows\resources\0409 |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_00406BFE |
0_2_00406BFE |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_6EB81BFF |
0_2_6EB81BFF |
Source: xKBLVUHoY6.exe |
Static PE information: invalid certificate |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Process Stats: CPU usage > 98% |
Source: xKBLVUHoY6.exe |
Virustotal: Detection: 36% |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File read: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Jump to behavior |
Source: xKBLVUHoY6.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034F7 |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lansat |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File created: C:\Users\user\AppData\Local\Temp\nswD9D0.tmp |
Jump to behavior |
Source: classification engine |
Classification label: mal80.troj.evad.winEXE@1/4@0/0 |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_004021AA CoCreateInstance, |
0_2_004021AA |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_00404954 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
0_2_00404954 |
Source: xKBLVUHoY6.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Yara match |
File source: 00000000.00000002.753579119.00000000031B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_6EB830C0 push eax; ret |
0_2_6EB830EE |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_6EB81BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6EB81BFF |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
File created: C:\Users\user\AppData\Local\Temp\nskE115.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
RDTSC instruction interceptor: First address: 00000000031B2C46 second address: 00000000031B2C46 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE5D8B46E4Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_0040290B FindFirstFileW, |
0_2_0040290B |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C13 |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_0040683D FindFirstFileW,FindClose, |
0_2_0040683D |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_6EB81BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6EB81BFF |
Source: C:\Users\user\Desktop\xKBLVUHoY6.exe |
Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034F7 |