Windows Analysis Report
HHGHJJUILn.exe

Overview

General Information

Sample Name: HHGHJJUILn.exe
Analysis ID: 764040
MD5: 103f2ca898f5c7285a3651f23d926218
SHA1: aded75bc932ddb0c9b17f257f82a5be822cab8e6
SHA256: 10633d83edea2308a01d9bcbd507737bf66e93550be49239cd801257f79c7d37
Tags: exe
Infos:

Detection

DarkCloud
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected DarkCloud
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Writes to foreign memory regions
Detected potential unwanted application
Tries to steal Crypto Currency Wallets
Writes or reads registry keys via WMI
Machine Learning detection for sample
Allocates memory in foreign processes
May check the online IP address of the machine
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large strings
Drops PE files to the user root directory
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Detected potential crypto function
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Drops PE files
Binary contains a suspicious time stamp
PE / OLE file has an invalid certificate
Drops PE files to the user directory
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Machine Learning detection for sample
Source: HHGHJJUILn.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.3.vbc.exe.502d8d0.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.unpack Avira: Label: TR/Dropper.Gen
Source: 4.0.vbc.exe.400000.0.unpack Avira: Label: TR/Dropper.Gen
Source: 4.2.vbc.exe.502d8d0.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: HHGHJJUILn.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: HHGHJJUILn.pdb source: HHGHJJUILn.exe
Source: Binary string: W.pdb4 source: HHGHJJUILn.exe, 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, vbsqlite3.dll.4.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BUMBUM.pdb source: HHGHJJUILn.exe, 00000000.00000002.248728659.00000252BF9A1000.00000004.00000800.00020000.00000000.sdmp, HHGHJJUILn.exe, 00000000.00000002.248645893.00000252BE0D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BUMBUM.pdbBSJB source: HHGHJJUILn.exe, 00000000.00000002.248728659.00000252BF9A1000.00000004.00000800.00020000.00000000.sdmp, HHGHJJUILn.exe, 00000000.00000002.248645893.00000252BE0D0000.00000004.08000000.00040000.00000000.sdmp

Networking
barindex
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe DNS query: name: showip.net
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.55.60.2 162.55.60.2
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: HHGHJJUILn.exe String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: HHGHJJUILn.exe String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0I
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0O
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0P
Source: HHGHJJUILn.exe String found in binary or memory: http://ocsp.digicert.com0R
Source: vbc.exe, 00000004.00000003.271857889.0000000005087000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271870029.000000000507C000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schema.org
Source: vbc.exe, 00000004.00000002.510113204.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/
Source: HHGHJJUILn.exe String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.maxmind.com
Source: LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: HHGHJJUILn.exe, 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000004.00000000.246767038.0000000000401000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000004.00000003.271857889.0000000005087000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271870029.000000000507C000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://showip.net/
Source: vbc.exe, 00000004.00000003.271857889.0000000005087000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271870029.000000000507C000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://showip.net/?checkip=
Source: vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unpkg.com/leaflet
Source: HHGHJJUILn.exe String found in binary or memory: https://www.digicert.com/CPS0
Source: vbc.exe, 00000004.00000003.272068154.00000000050B9000.00000004.00000020.00020000.00000000.sdmp, LogvangVfuSkfsNcHkxYKVGcfUjjBLLTgabama.4.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: vbc.exe, 00000004.00000003.271857889.0000000005087000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.281674526.0000000005085000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271870029.000000000507C000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.272371184.0000000005085000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271831148.0000000005090000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.openstreetmap.org/copyright
Source: unknown DNS traffic detected: queries for: showip.net
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1sqliteHost: showip.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.HHGHJJUILn.exe.252d0175a70.4.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 4.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.HHGHJJUILn.exe.252d0175a70.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Detected potential unwanted application
Source: HHGHJJUILn.exe PE Siganture Subject Chain: CN=Wen Jia Liu, O=Wen Jia Liu, L=Sydney, S=New South Wales, C=AU
Writes or reads registry keys via WMI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
.NET source code contains very large strings
Source: HHGHJJUILn.exe, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 745497
Source: HHGHJJUILn.exe, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 29301
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 837648
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 29301
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 837648
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs Long String: Length: 29301
Yara signature match
Source: 0.2.HHGHJJUILn.exe.252d0175a70.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 4.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.HHGHJJUILn.exe.252d0175a70.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: Process Memory Space: HHGHJJUILn.exe PID: 5460, type: MEMORYSTR Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Detected potential crypto function
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Code function: 0_2_00007FFDC87E0E1D 0_2_00007FFDC87E0E1D
PE file does not import any functions
Source: HHGHJJUILn.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: HHGHJJUILn.exe, 00000000.00000002.248728659.00000252BF9A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBUMBUM.dll. vs HHGHJJUILn.exe
Source: HHGHJJUILn.exe, 00000000.00000002.248645893.00000252BE0D0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameBUMBUM.dll. vs HHGHJJUILn.exe
Source: HHGHJJUILn.exe, 00000000.00000002.248401710.00000252BDF3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs HHGHJJUILn.exe
Source: HHGHJJUILn.exe, 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefirebase.exe vs HHGHJJUILn.exe
PE / OLE file has an invalid certificate
Source: HHGHJJUILn.exe Static PE information: invalid certificate
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\vbsqlite3.dll DCFCD16FBF0511D3F2B3792E5493FA22D7291E4BB2EFBFA5ADE5002A04FC2CAB
Source: vbsqlite3.dll.4.dr Static PE information: Section: UPX1 ZLIB complexity 0.9930182122564936
Source: HHGHJJUILn.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\HHGHJJUILn.exe C:\Users\user\Desktop\HHGHJJUILn.exe
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HHGHJJUILn.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@9/3@1/1
Source: HHGHJJUILn.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 47.53%
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: HHGHJJUILn.exe, 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000004.00000000.246767038.0000000000401000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: C*\AC:\Users\user1\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1sqlite.vbp
Source: vbc.exe, 00000004.00000002.509871994.000000000043F000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: =@*\AC:\Users\user1\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1sqlite.vbp
Source: HHGHJJUILn.exe String found in binary or memory: %/adD
Source: HHGHJJUILn.exe, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs Cryptographic APIs: 'CreateDecryptor'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: HHGHJJUILn.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: HHGHJJUILn.exe Static file information: File size 1631776 > 1048576
Source: HHGHJJUILn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: HHGHJJUILn.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x188800
Source: HHGHJJUILn.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: HHGHJJUILn.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: HHGHJJUILn.pdb source: HHGHJJUILn.exe
Source: Binary string: W.pdb4 source: HHGHJJUILn.exe, 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, vbsqlite3.dll.4.dr
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BUMBUM.pdb source: HHGHJJUILn.exe, 00000000.00000002.248728659.00000252BF9A1000.00000004.00000800.00020000.00000000.sdmp, HHGHJJUILn.exe, 00000000.00000002.248645893.00000252BE0D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BUMBUM.pdbBSJB source: HHGHJJUILn.exe, 00000000.00000002.248728659.00000252BF9A1000.00000004.00000800.00020000.00000000.sdmp, HHGHJJUILn.exe, 00000000.00000002.248645893.00000252BE0D0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: HHGHJJUILn.exe, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs .Net Code: Fb1AEOaU7 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs .Net Code: Fb1AEOaU7 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs .Net Code: Fb1AEOaU7 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: HHGHJJUILn.exe, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
PE file contains an invalid checksum
Source: HHGHJJUILn.exe Static PE information: real checksum: 0x194b5f should be: 0x1917bd
Source: vbsqlite3.dll.4.dr Static PE information: real checksum: 0x0 should be: 0x2ae74
Binary contains a suspicious time stamp
Source: HHGHJJUILn.exe Static PE information: 0xBC772981 [Thu Mar 13 08:46:57 2070 UTC]
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: HHGHJJUILn.exe, HHGHJJUILn/Form1.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'YuOqfTprM', 'MLNZSZRFrajNUp8qsp', 'QKFPvBtNpBg69j7Nnf', 'OX6eQ4cexP0VbKZYHd', 'bsysAD7ggZAVgKjpwe', 'pJgmfyX8ODddoG1ri3', 'EdoPmEr7rodWECslCW', 'Wp9BtVBZUNcCDe2G4j'
Source: HHGHJJUILn.exe, En1Psw4F6pV2BGk3HS/ksk0w2p0NeUeOsNX1k.cs High entropy of concatenated method names: 'tItAnDqvZw', 'q9cAVedEOK', 'vogA065LUG', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'megHtLN4uvGf4nCRjm', 'G4LOidn2EpGskKj5dn', 'UeEp48U6NOtmIrWXau', 'Yd6kaMVw5VqNsnPYj8'
Source: HHGHJJUILn.exe, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs High entropy of concatenated method names: 'Fb1AEOaU7', 'P6xUHAj56', '.cctor', 'A06XxWmccOiN4rKPjE', 'ckqFXlFonRXwg7hGMo', 'mi7ZZuYZOG800P2wrb', 'S2nGXdJDRjIatIq3yl', 'vKbcCMELP1Ff62L5Oc', 'dyH6VaCeOOc3qHO1sU'
Source: HHGHJJUILn.exe, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs High entropy of concatenated method names: '.cctor', 'w5iB4s0vtohFt', 'EVrnj8HXc', 'hW9V16hSn', 'XA20E1B6m', 'X9jZKh2WY', 'YuD7NMJ3H', 'yu2GulHW3', 'NSb63FLLs', 'ruvfdsjMx'
Source: HHGHJJUILn.exe, gJMOHJbIEe0MYsJbwl/GjqP19iwYoYd3r8X3Q.cs High entropy of concatenated method names: 'bttB4s00sthd0', '.ctor', '.cctor', 'P1FDtSURv5Uv1lFtlE', 'JVDxtvDUYWhjE6hJg7', 'hwBvASNOS9VEAeE2CW', 'nsq8D2qkGJ1RlLF3S8', 'oqM2QpLak1XUxIwwB6', 'wQNnYvW1BlqUUlaKig', 'yiPfGpOSQn7WMKo59Y'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, HHGHJJUILn/Form1.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'YuOqfTprM', 'MLNZSZRFrajNUp8qsp', 'QKFPvBtNpBg69j7Nnf', 'OX6eQ4cexP0VbKZYHd', 'bsysAD7ggZAVgKjpwe', 'pJgmfyX8ODddoG1ri3', 'EdoPmEr7rodWECslCW', 'Wp9BtVBZUNcCDe2G4j'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs High entropy of concatenated method names: 'Fb1AEOaU7', 'P6xUHAj56', '.cctor', 'A06XxWmccOiN4rKPjE', 'ckqFXlFonRXwg7hGMo', 'mi7ZZuYZOG800P2wrb', 'S2nGXdJDRjIatIq3yl', 'vKbcCMELP1Ff62L5Oc', 'dyH6VaCeOOc3qHO1sU'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, En1Psw4F6pV2BGk3HS/ksk0w2p0NeUeOsNX1k.cs High entropy of concatenated method names: 'tItAnDqvZw', 'q9cAVedEOK', 'vogA065LUG', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'megHtLN4uvGf4nCRjm', 'G4LOidn2EpGskKj5dn', 'UeEp48U6NOtmIrWXau', 'Yd6kaMVw5VqNsnPYj8'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs High entropy of concatenated method names: '.cctor', 'w5iB4s0vtohFt', 'EVrnj8HXc', 'hW9V16hSn', 'XA20E1B6m', 'X9jZKh2WY', 'YuD7NMJ3H', 'yu2GulHW3', 'NSb63FLLs', 'ruvfdsjMx'
Source: 0.0.HHGHJJUILn.exe.252bdc30000.0.unpack, gJMOHJbIEe0MYsJbwl/GjqP19iwYoYd3r8X3Q.cs High entropy of concatenated method names: 'bttB4s00sthd0', '.ctor', '.cctor', 'P1FDtSURv5Uv1lFtlE', 'JVDxtvDUYWhjE6hJg7', 'hwBvASNOS9VEAeE2CW', 'nsq8D2qkGJ1RlLF3S8', 'oqM2QpLak1XUxIwwB6', 'wQNnYvW1BlqUUlaKig', 'yiPfGpOSQn7WMKo59Y'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, HHGHJJUILn/Form1.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'YuOqfTprM', 'MLNZSZRFrajNUp8qsp', 'QKFPvBtNpBg69j7Nnf', 'OX6eQ4cexP0VbKZYHd', 'bsysAD7ggZAVgKjpwe', 'pJgmfyX8ODddoG1ri3', 'EdoPmEr7rodWECslCW', 'Wp9BtVBZUNcCDe2G4j'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, AcmWjvFtj9egtnnJX9/dZ7qkvqcNhO85yPNrX.cs High entropy of concatenated method names: 'Fb1AEOaU7', 'P6xUHAj56', '.cctor', 'A06XxWmccOiN4rKPjE', 'ckqFXlFonRXwg7hGMo', 'mi7ZZuYZOG800P2wrb', 'S2nGXdJDRjIatIq3yl', 'vKbcCMELP1Ff62L5Oc', 'dyH6VaCeOOc3qHO1sU'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, En1Psw4F6pV2BGk3HS/ksk0w2p0NeUeOsNX1k.cs High entropy of concatenated method names: 'tItAnDqvZw', 'q9cAVedEOK', 'vogA065LUG', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'megHtLN4uvGf4nCRjm', 'G4LOidn2EpGskKj5dn', 'UeEp48U6NOtmIrWXau', 'Yd6kaMVw5VqNsnPYj8'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, o3eGGqBtdpdaBbRpbh/yV5CsNT40LRKh3Lcnn.cs High entropy of concatenated method names: '.cctor', 'w5iB4s0vtohFt', 'EVrnj8HXc', 'hW9V16hSn', 'XA20E1B6m', 'X9jZKh2WY', 'YuD7NMJ3H', 'yu2GulHW3', 'NSb63FLLs', 'ruvfdsjMx'
Source: 0.2.HHGHJJUILn.exe.252bdc30000.0.unpack, gJMOHJbIEe0MYsJbwl/GjqP19iwYoYd3r8X3Q.cs High entropy of concatenated method names: 'bttB4s00sthd0', '.ctor', '.cctor', 'P1FDtSURv5Uv1lFtlE', 'JVDxtvDUYWhjE6hJg7', 'hwBvASNOS9VEAeE2CW', 'nsq8D2qkGJ1RlLF3S8', 'oqM2QpLak1XUxIwwB6', 'wQNnYvW1BlqUUlaKig', 'yiPfGpOSQn7WMKo59Y'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File created: C:\Users\Public\vbsqlite3.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File created: C:\Users\Public\vbsqlite3.dll Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File created: C:\Users\Public\vbsqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\HHGHJJUILn.exe TID: 2248 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Dropped PE file which has not been started: C:\Users\Public\vbsqlite3.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: vbc.exe, 00000004.00000002.510113204.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000003.271870029.000000000507C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Enables debug privileges
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43F000 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 440000 Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4D9A008 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Queries volume information: C:\Users\user\Desktop\HHGHJJUILn.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HHGHJJUILn.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DarkCloud
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d0175a70.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d0175a70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.246767038.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HHGHJJUILn.exe PID: 5460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4772, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4772, type: MEMORYSTR
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4772, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected DarkCloud
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d0175a70.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d0175a70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.HHGHJJUILn.exe.252d012dbe0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.246767038.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251576631.00000252D012D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: HHGHJJUILn.exe PID: 5460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4772, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4772, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764040 Sample: HHGHJJUILn.exe Startdate: 09/12/2022 Architecture: WINDOWS Score: 100 27 Malicious sample detected (through community Yara rule) 2->27 29 Yara detected DarkCloud 2->29 31 Yara detected Telegram RAT 2->31 33 5 other signatures 2->33 6 HHGHJJUILn.exe 1 2->6         started        process3 file4 21 C:\Users\user\AppData\...\HHGHJJUILn.exe.log, CSV 6->21 dropped 35 Writes to foreign memory regions 6->35 37 Allocates memory in foreign processes 6->37 39 Injects a PE file into a foreign processes 6->39 10 vbc.exe 6->10         started        13 vbc.exe 15 6->13         started        17 vbc.exe 6->17         started        19 vbc.exe 6->19         started        signatures5 process6 dnsIp7 41 May check the online IP address of the machine 10->41 43 Drops PE files to the user root directory 10->43 45 Writes or reads registry keys via WMI 10->45 25 showip.net 162.55.60.2, 49711, 80 ACPCA United States 13->25 23 C:\Users\Public\vbsqlite3.dll, PE32 13->23 dropped 47 Tries to harvest and steal browser information (history, passwords, etc) 13->47 49 Tries to steal Crypto Currency Wallets 13->49 file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.55.60.2
 showip.net United States
35893 ACPCA false

Contacted Domains

Name IP Active
showip.net 162.55.60.2 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://showip.net/ false
    		high