Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe

Overview

General Information

Sample Name:SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
Analysis ID:755894
MD5:2c37cb553314943214dc79d2d5cd95d2
SHA1:8d729ace154aae255cc7d20e0038889c1a16b30b
SHA256:5cfdb9f856907336025bbd526f7383ae8edbce669348b8e330251dfe21072c8f
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

  • System is w10x64
  • cleanup
{"C2 list": ["www.2635westkaylaneprescott.com/ndgi/"], "decoy": ["vuicotvxrejp3il.xyz", "w3fa6.net", "sappuno02.com", "konstruksirumah.xyz", "usalifehealth.com", "and1f.xyz", "atenmentfstinfdow.beauty", "primepipe.net", "roundhouseny.com", "alexandermcqueen.icu", "transporteavalos.com", "spankmetaverse.xyz", "jhccowholesale.com", "bielefeldgebaeudereinigung.com", "saintraphaelschool.com", "larifaa.online", "dejabrew.info", "izabelaeraphael.com", "granniestoneet.com", "greensourceseed.com", "jawaahirulhikmah.com", "2lipcolours.com", "ginzou.com", "vestradgivning.online", "atlasdublinresidence.com", "bfine.xyz", "decision-art.com", "nicebayloans.com", "pendingissue.biz", "troiancircular.com", "raftingtennesssee.com", "autistal.xyz", "purposeinplans.com", "socofm.com", "dafuweng0471.com", "transformcoach.info", "vugz.info", "isabellesroom.com", "kasdawerf.xyz", "angelicindia.com", "jmakerpumploc.com", "departmen.store", "kalpataruplotsariaplots.net", "mosqueenarbonne.com", "tititinews.com", "santeoglobal.com", "cornharvestdirect.com", "chickensoesco.com", "softelbow30.com", "fuxeonfire.com", "soospeter.com", "lastikfiyatlari.online", "northlandproshop.com", "youbelongstojoy.com", "asfalt-podrezkovo.store", "servequin.com", "heti.ink", "gulfingroupinvest.com", "gastries.info", "spunklane.com", "acompanhanteslux.com", "bbti.world", "juiceofjoy.com", "tlaaccounting.net"]}
SourceRuleDescriptionAuthorStrings
00000000.00000002.268979891.0000000003549000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x5251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1bb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x99bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x148a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x8908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x958a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1a8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1b8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x17809:$sqlite3step: 68 34 1C 7B E1
      • 0x1791c:$sqlite3step: 68 34 1C 7B E1
      • 0x17838:$sqlite3text: 68 38 2A 90 C5
      • 0x1795d:$sqlite3text: 68 38 2A 90 C5
      • 0x1784b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x17973:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 8 entries
      SourceRuleDescriptionAuthorStrings
      1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
        • 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x17a09:$sqlite3step: 68 34 1C 7B E1
        • 0x17b1c:$sqlite3step: 68 34 1C 7B E1
        • 0x17a38:$sqlite3text: 68 38 2A 90 C5
        • 0x17b5d:$sqlite3text: 68 38 2A 90 C5
        • 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
        0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.3282f54.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          Click to see the 11 entries
          No Sigma rule has matched
          No Snort rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeReversingLabs: Detection: 29%
          Source: Yara matchFile source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: www.2635westkaylaneprescott.com/ndgi/Avira URL Cloud: Label: malware
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeJoe Sandbox ML: detected
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.2635westkaylaneprescott.com/ndgi/"], "decoy": ["vuicotvxrejp3il.xyz", "w3fa6.net", "sappuno02.com", "konstruksirumah.xyz", "usalifehealth.com", "and1f.xyz", "atenmentfstinfdow.beauty", "primepipe.net", "roundhouseny.com", "alexandermcqueen.icu", "transporteavalos.com", "spankmetaverse.xyz", "jhccowholesale.com", "bielefeldgebaeudereinigung.com", "saintraphaelschool.com", "larifaa.online", "dejabrew.info", "izabelaeraphael.com", "granniestoneet.com", "greensourceseed.com", "jawaahirulhikmah.com", "2lipcolours.com", "ginzou.com", "vestradgivning.online", "atlasdublinresidence.com", "bfine.xyz", "decision-art.com", "nicebayloans.com", "pendingissue.biz", "troiancircular.com", "raftingtennesssee.com", "autistal.xyz", "purposeinplans.com", "socofm.com", "dafuweng0471.com", "transformcoach.info", "vugz.info", "isabellesroom.com", "kasdawerf.xyz", "angelicindia.com", "jmakerpumploc.com", "departmen.store", "kalpataruplotsariaplots.net", "mosqueenarbonne.com", "tititinews.com", "santeoglobal.com", "cornharvestdirect.com", "chickensoesco.com", "softelbow30.com", "fuxeonfire.com", "soospeter.com", "lastikfiyatlari.online", "northlandproshop.com", "youbelongstojoy.com", "asfalt-podrezkovo.store", "servequin.com", "heti.ink", "gulfingroupinvest.com", "gastries.info", "spunklane.com", "acompanhanteslux.com", "bbti.world", "juiceofjoy.com", "tlaaccounting.net"]}
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000002.267578947.0000000001510000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.265561008.0000000001371000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.263133405.00000000011D4000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000002.267578947.0000000001510000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.265561008.0000000001371000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.263133405.00000000011D4000.00000004.00000800.00020000.00000000.sdmp

          Networking

          barindex
          Source: Malware configuration extractorURLs: www.2635westkaylaneprescott.com/ndgi/
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.272505714.0000000007232000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.264008229.000000000147B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

          E-Banking Fraud

          barindex
          Source: Yara matchFile source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.3282f54.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.32a0724.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID: 5272, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID: 5208, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 1.0.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.3282f54.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.32a0724.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.44aef60.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.45233b0.5.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000000.262712520.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID: 5272, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe PID: 5208, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_0171C1640_2_0171C164
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_0171E5B00_2_0171E5B0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_0171E5A10_2_0171E5A1
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F06E80_2_056F06E8
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F28680_2_056F2868
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F66600_2_056F6660
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F66500_2_056F6650
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F06D90_2_056F06D9
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F23200_2_056F2320
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F23300_2_056F2330
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_056F22FA0_2_056F22FA
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0153F9001_2_0153F900
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015541201_2_01554120
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0154C1C01_2_0154C1C0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015529901_2_01552990
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015599BF1_2_015599BF
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0160E8241_2_0160E824
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0156701D1_2_0156701D
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015368001_2_01536800
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F10021_2_015F1002
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155A8301_2_0155A830
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_016028EC1_2_016028EC
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F60F51_2_015F60F5
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0154B0901_2_0154B090
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_016020A81_2_016020A8
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015620A01_2_015620A0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015DCB4F1_2_015DCB4F
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155AB401_2_0155AB40
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151337D1_2_0151337D
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015533601_2_01553360
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F231B1_2_015F231B
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01602B281_2_01602B28
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155A3091_2_0155A309
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F03DA1_2_015F03DA
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015FDBD21_2_015FDBD2
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0156ABD81_2_0156ABD8
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01588BE81_2_01588BE8
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015E23E31_2_015E23E3
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155EB9A1_2_0155EB9A
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015133821_2_01513382
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015DEB8A1_2_015DEB8A
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0156138B1_2_0156138B
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0156EBB01_2_0156EBB0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151225E1_2_0151225E
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F5A4F1_2_015F5A4F
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155B2361_2_0155B236
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015EFA2B1_2_015EFA2B
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015FE2C51_2_015FE2C5
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F4AEF1_2_015F4AEF
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_016032A91_2_016032A9
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_016022AE1_2_016022AE
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01552D501_2_01552D50
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01601D551_2_01601D55
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01602D071_2_01602D07
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01530D201_2_01530D20
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0154D5E01_2_0154D5E0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_016025DD1_2_016025DD
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015625811_2_01562581
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F2D821_2_015F2D82
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015665A01_2_015665A0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0155B4771_2_0155B477
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015FD4661_2_015FD466
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0154841F1_2_0154841F
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015524301_2_01552430
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01564CD41_2_01564CD4
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F44961_2_015F4496
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015194B81_2_015194B8
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01601FF11_2_01601FF1
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0160DFCE1_2_0160DFCE
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015F67E21_2_015F67E2
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015BAE601_2_015BAE60
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015FD6161_2_015FD616
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015556001_2_01555600
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01556E301_2_01556E30
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01602EF71_2_01602EF7
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015E1EB61_2_015E1EB6
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: String function: 0158D08C appears 47 times
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: String function: 0153B150 appears 159 times
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: String function: 015C5720 appears 81 times
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579860 NtQuerySystemInformation,LdrInitializeThunk,1_2_01579860
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579660 NtAllocateVirtualMemory,LdrInitializeThunk,1_2_01579660
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015796E0 NtFreeVirtualMemory,LdrInitializeThunk,1_2_015796E0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579950 NtQueueApcThread,1_2_01579950
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579910 NtAdjustPrivilegesToken,1_2_01579910
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015799D0 NtCreateProcessEx,1_2_015799D0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015799A0 NtCreateSection,1_2_015799A0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579840 NtDelayExecution,1_2_01579840
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0157B040 NtSuspendThread,1_2_0157B040
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579820 NtEnumerateKey,1_2_01579820
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015798F0 NtReadVirtualMemory,1_2_015798F0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015798A0 NtWriteVirtualMemory,1_2_015798A0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579B00 NtSetValueKey,1_2_01579B00
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0157A3B0 NtGetContextThread,1_2_0157A3B0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579A50 NtCreateFile,1_2_01579A50
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579A10 NtQuerySection,1_2_01579A10
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579A00 NtProtectVirtualMemory,1_2_01579A00
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579A20 NtResumeThread,1_2_01579A20
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579A80 NtOpenDirectoryObject,1_2_01579A80
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579540 NtReadFile,1_2_01579540
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579560 NtWriteFile,1_2_01579560
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0157AD30 NtSetContextThread,1_2_0157AD30
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579520 NtWaitForSingleObject,1_2_01579520
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015795D0 NtClose,1_2_015795D0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015795F0 NtQueryInformationFile,1_2_015795F0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0157A770 NtOpenThread,1_2_0157A770
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579770 NtSetInformationFile,1_2_01579770
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579760 NtOpenProcess,1_2_01579760
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0157A710 NtOpenProcessToken,1_2_0157A710
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579710 NtQueryInformationToken,1_2_01579710
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579730 NtQueryVirtualMemory,1_2_01579730
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579FE0 NtCreateMutant,1_2_01579FE0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579780 NtMapViewOfSection,1_2_01579780
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015797A0 NtUnmapViewOfSection,1_2_015797A0
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579650 NtQueryValueKey,1_2_01579650
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579670 NtQueryInformationProcess,1_2_01579670
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01579610 NtEnumerateValueKey,1_2_01579610
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_015796D0 NtCreateKey,1_2_015796D0
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000000.243748362.0000000000D84000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameyFcW.exeB vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.264008229.000000000147B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.275549628.0000000007990000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.270529665.00000000044AE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.266387939.0000000003261000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000002.266387939.0000000003261000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.266489821.0000000001490000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.263873744.00000000012EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000002.268632378.000000000162F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeBinary or memory string: OriginalFilenameyFcW.exeB vs SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeReversingLabs: Detection: 29%
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe.logJump to behavior
          Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000000.243588948.0000000000CA2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: insert into User_Transportation(UserID,TransportationID) values (@UserID,@TransID);
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000000.243588948.0000000000CA2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: insert into TourPlace(Name,Location,TicketPrice) values (@name,@location,@ticket);
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000000.00000000.243588948.0000000000CA2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: insert into User_TourPlace(UserID,TourPlaceID) values (@UserID,@TourplaceID);
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeString found in binary or memory: AddUserButton'AddUserPhoneTextbox'AdduserEmailtextbox-Adduserpasswordtextbox
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeString found in binary or memory: Username:-AddusertextBoxUsernameCash
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000002.267578947.0000000001510000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.265561008.0000000001371000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.263133405.00000000011D4000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000002.267578947.0000000001510000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.265561008.0000000001371000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exe, 00000001.00000003.263133405.00000000011D4000.00000004.00000800.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_0171F978 pushad ; iretd 0_2_0171F979
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 0_2_01717AFF push eax; retf 0_2_01717B8D
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151191C pushfd ; iretd 1_2_01511939
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0158D0D1 push ecx; ret 1_2_0158D0E4
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151225E push eax; retf 1_2_0151321C
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01519271 push es; iretd 1_2_01519278
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151427E pushad ; retf 000Dh1_2_0151427F
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151322C push eax; retf 1_2_0151321C
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01514288 pushad ; retf 1_2_01514289
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_0151A7C0 push es; iretd 1_2_0151A7C1
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeCode function: 1_2_01513F9F pushad ; ret 1_2_01513FA0
          Source: initial sampleStatic PE information: section name: .text entropy: 7.649413315465482
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.16304.13478.exeProcess information set: NOOPENFILEERRORBOX