Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
server.exe

Overview

General Information

Sample Name:server.exe
Analysis ID:826308
MD5:8f092511c91bfc1f2516e420739a7967
SHA1:dc67d8f55a6591d16c2709ea65ad143e3a216ec0
SHA256:9261b47b4fd67523f7afe640e55ccb95ec8b154b5dfa34a8564986ac3e97fe1a
Tags:agenziaentrateexegoziisfbmefmiseursnif
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Snort IDS alert for network traffic
Yara detected Ursnif
Found evasive API chain (may stop execution after checking system information)
Writes or reads registry keys via WMI
Writes registry values via WMI
Found API chain indicative of debugger detection
Machine Learning detection for sample
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Internet Provider seen in connection with other malware
Contains functionality to call native functions
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware

Classification

  • System is w10x64
  • server.exe (PID: 5540 cmdline: C:\Users\user\Desktop\server.exe MD5: 8F092511C91BFC1F2516E420739A7967)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Gozi, Ursnif2000 Ursnif aka Snifula2006 Gozi v1.0, Gozi CRM, CRM, Papras2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)-> 2010 Gozi Prinimalka -> Vawtrak/NeverquestIn 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.gozi
{"RSA Public Key": "2cHitNE2khtX8MPowN3OuEF+nIJiRQvDS0CByWczHAmlx7InAyPYhqz4W4BdwOQhPXM+cNmTKZrjXkeaD1W/JReU+0QfnRaZLQzMkbf/6hntYeJLN9kVYaXwOSubcfndLd/IRF3zHco37HpGyfr/fx+pYcUFQUpDPSBwxpcqOgAGHU0ELflY4Wg7JTro/JzFnlTf/qZRLIK0F3z73FRQhjYYH8ldszb/+eADX8rn6ird+QrxU0NdIdel89Q7IsIw6+kcDa/Uh8s29ZPGfilEQcNwZsKPhbL1nQo8gRUU9nCXs8mGibasUhj7JSzvSDXMce/idAcO3inRDu0kAkFPSSWXYHucvOV7UqKvwvqosHo=", "c2_domain": ["checklist.skype.com", "62.173.142.51", "94.103.183.153", "193.233.175.111", "109.248.11.145", "31.41.44.106", "191.96.251.201"], "botnet": "7713", "server": "50", "serpent_key": "rqDYWFa4uPXuBFMj", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
SourceRuleDescriptionAuthorStrings
00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0x1228:$a1: /C ping localhost -n %u && del "%s"
    • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xa9c:$a5: filename="%.4u.%lu"
    • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe6d:$a9: &whoami=%s
    • 0xe56:$a10: %u.%u_%u_%u_x%u
    • 0xd63:$a11: size=%u&hash=0x%08x
    • 0xb1d:$a12: &uptime=%u
    • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
    • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1ce8:$a9: Software\AppDataLow\Software\Microsoft\
    00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
      • 0x1228:$a1: /C ping localhost -n %u && del "%s"
      • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
      • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
      • 0xa9c:$a5: filename="%.4u.%lu"
      • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
      • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xe6d:$a9: &whoami=%s
      • 0xe56:$a10: %u.%u_%u_%u_x%u
      • 0xd63:$a11: size=%u&hash=0x%08x
      • 0xb1d:$a12: &uptime=%u
      • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
      • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
      Click to see the 27 entries
      No Sigma rule has matched
      Timestamp:192.168.2.562.173.142.5149680802033203 03/14/23-16:02:33.550566
      SID:2033203
      Source Port:49680
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: server.exeReversingLabs: Detection: 32%
      Source: server.exeVirustotal: Detection: 43%Perma Link
      Source: http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2Avira URL Cloud: Label: malware
      Source: http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2BWc8v/UHxdAMkcyeaROQd9/EwiLplzlm9gCiDQ/KqEVG_2BN1u2apPrXD/iYwyB9P6y/3dh1O1SBALUj6nSMRJfH/HHlM5d4xQO9d95rkA_2/Bt59zcQMsfJpOgJC8GeSrH/5REGnF8guLwya/xQ1cfd2Y/w3tCRH4bjXIzu_2B_2F_2B5/MmfV_2FK_2/B5ux_2BgxJ6omqMfT/iSBh1mrWB9_2/BRaJgBOq4gEVdF7OIVd_2B/4.jlkAvira URL Cloud: Label: malware
      Source: http://62.173.142.51/Avira URL Cloud: Label: malware
      Source: server.exeJoe Sandbox ML: detected
      Source: 0.2.server.exe.400000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen7
      Source: 00000000.00000002.580738483.0000000002689000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "2cHitNE2khtX8MPowN3OuEF+nIJiRQvDS0CByWczHAmlx7InAyPYhqz4W4BdwOQhPXM+cNmTKZrjXkeaD1W/JReU+0QfnRaZLQzMkbf/6hntYeJLN9kVYaXwOSubcfndLd/IRF3zHco37HpGyfr/fx+pYcUFQUpDPSBwxpcqOgAGHU0ELflY4Wg7JTro/JzFnlTf/qZRLIK0F3z73FRQhjYYH8ldszb/+eADX8rn6ird+QrxU0NdIdel89Q7IsIw6+kcDa/Uh8s29ZPGfilEQcNwZsKPhbL1nQo8gRUU9nCXs8mGibasUhj7JSzvSDXMce/idAcO3inRDu0kAkFPSSWXYHucvOV7UqKvwvqosHo=", "c2_domain": ["checklist.skype.com", "62.173.142.51", "94.103.183.153", "193.233.175.111", "109.248.11.145", "31.41.44.106", "191.96.251.201"], "botnet": "7713", "server": "50", "serpent_key": "rqDYWFa4uPXuBFMj", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

      Compliance

      barindex
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack
      Source: server.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: C:\Users\user\Desktop\server.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll

      Networking

      barindex
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49680 -> 62.173.142.51:80
      Source: global trafficHTTP traffic detected: GET /drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2BWc8v/UHxdAMkcyeaROQd9/EwiLplzlm9gCiDQ/KqEVG_2BN1u2apPrXD/iYwyB9P6y/3dh1O1SBALUj6nSMRJfH/HHlM5d4xQO9d95rkA_2/Bt59zcQMsfJpOgJC8GeSrH/5REGnF8guLwya/xQ1cfd2Y/w3tCRH4bjXIzu_2B_2F_2B5/MmfV_2FK_2/B5ux_2BgxJ6omqMfT/iSBh1mrWB9_2/BRaJgBOq4gEVdF7OIVd_2B/4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 62.173.142.51Connection: Keep-AliveCache-Control: no-cache
      Source: Joe Sandbox ViewASN Name: SPACENET-ASInternetServiceProviderRU SPACENET-ASInternetServiceProviderRU
      Source: unknownDNS traffic detected: query: checklist.skype.com replaycode: Name error (3)
      Source: Joe Sandbox ViewIP Address: 62.173.142.51 62.173.142.51
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.51
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.51
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.51
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.51
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.51
      Source: server.exe, 00000000.00000002.580755093.000000000281C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://62.173
      Source: server.exe, 00000000.00000002.580573765.0000000000706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://62.173.142.51/
      Source: server.exe, 00000000.00000002.580573765.0000000000706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2
      Source: unknownDNS traffic detected: queries for: checklist.skype.com
      Source: global trafficHTTP traffic detected: GET /drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2BWc8v/UHxdAMkcyeaROQd9/EwiLplzlm9gCiDQ/KqEVG_2BN1u2apPrXD/iYwyB9P6y/3dh1O1SBALUj6nSMRJfH/HHlM5d4xQO9d95rkA_2/Bt59zcQMsfJpOgJC8GeSrH/5REGnF8guLwya/xQ1cfd2Y/w3tCRH4bjXIzu_2B_2F_2B5/MmfV_2FK_2/B5ux_2BgxJ6omqMfT/iSBh1mrWB9_2/BRaJgBOq4gEVdF7OIVd_2B/4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 62.173.142.51Connection: Keep-AliveCache-Control: no-cache

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Source: Yara matchFile source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTR

      E-Banking Fraud

      barindex
      Source: Yara matchFile source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTR

      System Summary

      barindex
      Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.580453253.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
      Source: 00000000.00000002.580553464.00000000006A8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
      Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: server.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.580453253.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
      Source: 00000000.00000002.580553464.00000000006A8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
      Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_0040110B GetProcAddress,NtCreateSection,memset,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401459 NtMapViewOfSection,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_004019F1 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00541C58 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,CreateThread,QueueUserAPC,GetLastError,TerminateThread,SetLastError,WaitForSingleObject,GetExitCodeThread,GetLastError,GetLastError,
      Source: server.exeReversingLabs: Detection: 32%
      Source: server.exeVirustotal: Detection: 43%
      Source: server.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\server.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\server.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
      Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@1/1
      Source: C:\Users\user\Desktop\server.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll

      Data Obfuscation

      barindex
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: Yara matchFile source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTR
      Source: C:\Users\user\Desktop\server.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\server.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Source: C:\Users\user\Desktop\server.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
      Source: C:\Users\user\Desktop\server.exeAPI call chain: ExitProcess graph end node
      Source: C:\Users\user\Desktop\server.exeAPI call chain: ExitProcess graph end node

      Anti Debugging

      barindex
      Source: C:\Users\user\Desktop\server.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00540D90 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_0054092B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,
      Source: C:\Users\user\Desktop\server.exeCode function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,CreateThread,QueueUserAPC,GetLastError,TerminateThread,SetLastError,WaitForSingleObject,GetExitCodeThread,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401D68 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_004015B0 GetSystemTimeAsFileTime,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 5540, type: MEMORYSTR
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts2
      Windows Management Instrumentation
      Path InterceptionPath Interception1
      Virtualization/Sandbox Evasion
      OS Credential Dumping1
      System Time Discovery
      Remote ServicesData from Local SystemExfiltration Over Other Network Medium2
      Non-Application Layer Protocol
      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default Accounts11
      Native API
      Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts21
      Software Packing
      LSASS Memory1
      Security Software Discovery
      Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth12
      Application Layer Protocol
      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
      Virtualization/Sandbox Evasion
      SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
      Ingress Tool Transfer
      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS114
      System Information Discovery
      Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
      Remote System Discovery
      SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      server.exe32%ReversingLabsWin32.Trojan.Generic
      server.exe43%VirustotalBrowse
      server.exe100%Joe Sandbox ML
      No Antivirus matches
      SourceDetectionScannerLabelLinkDownload
      0.2.server.exe.680000.2.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.server.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.Gen7Download File
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://62.173.142.51/2%VirustotalBrowse
      http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2100%Avira URL Cloudmalware
      http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2BWc8v/UHxdAMkcyeaROQd9/EwiLplzlm9gCiDQ/KqEVG_2BN1u2apPrXD/iYwyB9P6y/3dh1O1SBALUj6nSMRJfH/HHlM5d4xQO9d95rkA_2/Bt59zcQMsfJpOgJC8GeSrH/5REGnF8guLwya/xQ1cfd2Y/w3tCRH4bjXIzu_2B_2F_2B5/MmfV_2FK_2/B5ux_2BgxJ6omqMfT/iSBh1mrWB9_2/BRaJgBOq4gEVdF7OIVd_2B/4.jlk100%Avira URL Cloudmalware
      http://62.1730%VirustotalBrowse
      http://62.173.142.51/100%Avira URL Cloudmalware
      http://62.1730%Avira URL Cloudsafe
      NameIPActiveMaliciousAntivirus DetectionReputation
      checklist.skype.com
      unknown
      unknownfalse
        high
        NameMaliciousAntivirus DetectionReputation
        http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2BWc8v/UHxdAMkcyeaROQd9/EwiLplzlm9gCiDQ/KqEVG_2BN1u2apPrXD/iYwyB9P6y/3dh1O1SBALUj6nSMRJfH/HHlM5d4xQO9d95rkA_2/Bt59zcQMsfJpOgJC8GeSrH/5REGnF8guLwya/xQ1cfd2Y/w3tCRH4bjXIzu_2B_2F_2B5/MmfV_2FK_2/B5ux_2BgxJ6omqMfT/iSBh1mrWB9_2/BRaJgBOq4gEVdF7OIVd_2B/4.jlktrue
        • Avira URL Cloud: malware
        unknown
        NameSourceMaliciousAntivirus DetectionReputation
        http://62.173.142.51/server.exe, 00000000.00000002.580573765.0000000000706000.00000004.00000020.00020000.00000000.sdmpfalse
        • 2%, Virustotal, Browse
        • Avira URL Cloud: malware
        unknown
        http://62.173server.exe, 00000000.00000002.580755093.000000000281C000.00000004.00000010.00020000.00000000.sdmpfalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        low
        http://62.173.142.51/drew/kjSOZcm1saisXVulw/nMJdjuoxI5rY/D8rf0rwxZvy/xTo4u6qyfG2cqh/DrEm9eSMLtL3Mt_2server.exe, 00000000.00000002.580573765.0000000000706000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: malware
        unknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        62.173.142.51
        unknownRussian Federation
        34300SPACENET-ASInternetServiceProviderRUtrue
        Joe Sandbox Version:37.0.0 Beryl
        Analysis ID:826308
        Start date and time:2023-03-14 15:59:46 +01:00
        Joe Sandbox Product:CloudBasic
        Overall analysis duration:0h 5m 57s
        Hypervisor based Inspection enabled:false
        Report type:light
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
        Number of analysed new started processes analysed:5
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • HDC enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample file name:server.exe
        Detection:MAL
        Classification:mal100.troj.evad.winEXE@1/0@1/1
        EGA Information:
        • Successful, ratio: 100%
        HDC Information:
        • Successful, ratio: 31.5% (good quality ratio 31.5%)
        • Quality average: 89%
        • Quality standard deviation: 15.4%
        HCA Information:
        • Successful, ratio: 90%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe
        • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        No simulations
        No context
        No context
        No context
        No context
        No context
        No created / dropped files found
        File type:PE32 executable (GUI) Intel 80386, for MS Windows
        Entropy (8bit):6.482937257572218
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.96%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:server.exe
        File size:192000
        MD5:8f092511c91bfc1f2516e420739a7967
        SHA1:dc67d8f55a6591d16c2709ea65ad143e3a216ec0
        SHA256:9261b47b4fd67523f7afe640e55ccb95ec8b154b5dfa34a8564986ac3e97fe1a
        SHA512:500fa61eec6d02ed95e8a36ffe7160cb1833cd605e3c994d2e1cf09fb7bfd420b1ec3d8f296f863f309fb558afdd77253f5c541dbff1053cc5fbe14df598a154
        SSDEEP:1536:FiqBYFyzXY04aevCQ6V4PLi5jYhsQUFYXxOT6jKBTfjMMTxYjlLmN1j+s8OyWYYE:FfwGezi5jYzTjYMMTxuLmz+scqt7
        TLSH:9A142A0392B07D54F6318A32BE3ECAE9B62FFA514F29776622186E1F05B1071CD62717
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U....j...j...j..~.\..j..~.i..j..~.].Hj....d..j...j..bj..~.X..j..~.m..j..~.j..j..Rich.j..........PE..L....8.b...................
        Icon Hash:70d2eeeacacaeadd
        Entrypoint:0x4030a3
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x400000
        Subsystem:windows gui
        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
        DLL Characteristics:TERMINAL_SERVER_AWARE
        Time Stamp:0x62AC38B0 [Fri Jun 17 08:17:52 2022 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:5
        OS Version Minor:1
        File Version Major:5
        File Version Minor:1
        Subsystem Version Major:5
        Subsystem Version Minor:1
        Import Hash:479608e06cc12a8fdc6e43a7370e252b
        Instruction
        call 00007F2244AEFFEEh
        jmp 00007F2244AED78Eh
        mov edi, edi
        push ebp
        mov ebp, esp
        mov eax, dword ptr [ebp+08h]
        xor ecx, ecx
        cmp eax, dword ptr [0040D008h+ecx*8]
        je 00007F2244AED915h
        inc ecx
        cmp ecx, 2Dh
        jc 00007F2244AED8F3h
        lea ecx, dword ptr [eax-13h]
        cmp ecx, 11h
        jnbe 00007F2244AED910h
        push 0000000Dh
        pop eax
        pop ebp
        ret
        mov eax, dword ptr [0040D00Ch+ecx*8]
        pop ebp
        ret
        add eax, FFFFFF44h
        push 0000000Eh
        pop ecx
        cmp ecx, eax
        sbb eax, eax
        and eax, ecx
        add eax, 08h
        pop ebp
        ret
        call 00007F2244AEFC65h
        test eax, eax
        jne 00007F2244AED908h
        mov eax, 0040D170h
        ret
        add eax, 08h
        ret
        call 00007F2244AEFC52h
        test eax, eax
        jne 00007F2244AED908h
        mov eax, 0040D174h
        ret
        add eax, 0Ch
        ret
        mov edi, edi
        push ebp
        mov ebp, esp
        push esi
        call 00007F2244AED8E7h
        mov ecx, dword ptr [ebp+08h]
        push ecx
        mov dword ptr [eax], ecx
        call 00007F2244AED887h
        pop ecx
        mov esi, eax
        call 00007F2244AED8C1h
        mov dword ptr [eax], esi
        pop esi
        pop ebp
        ret
        mov edi, edi
        push ebp
        mov ebp, esp
        mov ecx, dword ptr [ebp+08h]
        test ecx, ecx
        je 00007F2244AED91Dh
        push FFFFFFE0h
        xor edx, edx
        pop eax
        div ecx
        cmp eax, dword ptr [ebp+0Ch]
        jnc 00007F2244AED911h
        call 00007F2244AED89Fh
        mov dword ptr [eax], 0000000Ch
        xor eax, eax
        pop ebp
        ret
        imul ecx, dword ptr [ebp+0Ch]
        push esi
        mov esi, ecx
        test esi, esi
        jne 00007F2244AED903h
        Programming Language:
        • [C++] VS2010 build 30319
        • [ASM] VS2010 build 30319
        • [ C ] VS2010 build 30319
        • [IMP] VS2008 SP1 build 30729
        • [RES] VS2010 build 30319
        • [LNK] VS2010 build 30319
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0xb73c0x50.text
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x9e0000x10710.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2c200x40.text
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x10000x1ac.text
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000xb0dc0xb200False0.5144838483146067data6.004854081582009IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .data0xd0000x9058c0x13000False0.9473555715460527data7.85866639754507IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rsrc0x9e0000x107100x10800False0.29835464015151514data3.787774889182005IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountry
        RT_CURSOR0xac9480x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
        RT_CURSOR0xaca900x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
        RT_CURSOR0xacbc00xf0Device independent bitmap graphic, 24 x 48 x 1, image size 0
        RT_CURSOR0xaccb00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
        RT_ICON0x9e6d00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishFinland
        RT_ICON0x9e6d00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishNorway
        RT_ICON0x9e6d00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishSweden
        RT_ICON0x9ef780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishFinland
        RT_ICON0x9ef780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishNorway
        RT_ICON0x9ef780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishSweden
        RT_ICON0xa00480xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsSami LappishFinland
        RT_ICON0xa00480xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsSami LappishNorway
        RT_ICON0xa00480xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsSami LappishSweden
        RT_ICON0xa0ef00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsSami LappishFinland
        RT_ICON0xa0ef00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsSami LappishNorway
        RT_ICON0xa0ef00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsSami LappishSweden
        RT_ICON0xa17980x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsSami LappishFinland
        RT_ICON0xa17980x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsSami LappishNorway
        RT_ICON0xa17980x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsSami LappishSweden
        RT_ICON0xa1e600x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsSami LappishFinland
        RT_ICON0xa1e600x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsSami LappishNorway
        RT_ICON0xa1e600x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsSami LappishSweden
        RT_ICON0xa23c80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600Sami LappishFinland
        RT_ICON0xa23c80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600Sami LappishNorway
        RT_ICON0xa23c80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600Sami LappishSweden
        RT_ICON0xa49700x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224Sami LappishFinland
        RT_ICON0xa49700x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224Sami LappishNorway
        RT_ICON0xa49700x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224Sami LappishSweden
        RT_ICON0xa5a180x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400Sami LappishFinland
        RT_ICON0xa5a180x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400Sami LappishNorway
        RT_ICON0xa5a180x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400Sami LappishSweden
        RT_ICON0xa63a00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088Sami LappishFinland
        RT_ICON0xa63a00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088Sami LappishNorway
        RT_ICON0xa63a00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088Sami LappishSweden
        RT_ICON0xa68800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishFinland
        RT_ICON0xa68800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishNorway
        RT_ICON0xa68800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishSweden
        RT_ICON0xa77280x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishFinland
        RT_ICON0xa77280x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishNorway
        RT_ICON0xa77280x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishSweden
        RT_ICON0xa7df00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishFinland
        RT_ICON0xa7df00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishNorway
        RT_ICON0xa7df00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishSweden
        RT_ICON0xa83580x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishFinland
        RT_ICON0xa83580x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishNorway
        RT_ICON0xa83580x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishSweden
        RT_ICON0xaa9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishFinland
        RT_ICON0xaa9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishNorway
        RT_ICON0xaa9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishSweden
        RT_ICON0xab9a80x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishFinland
        RT_ICON0xab9a80x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishNorway
        RT_ICON0xab9a80x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishSweden
        RT_ICON0xac3300x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishFinland
        RT_ICON0xac3300x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishNorway
        RT_ICON0xac3300x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishSweden
        RT_STRING0xadfe00x3bedataSami LappishFinland
        RT_STRING0xadfe00x3bedataSami LappishNorway
        RT_STRING0xadfe00x3bedataSami LappishSweden
        RT_STRING0xae3a00x36adataSami LappishFinland
        RT_STRING0xae3a00x36adataSami LappishNorway
        RT_STRING0xae3a00x36adataSami LappishSweden
        RT_ACCELERATOR0xac8a80x90dataSami LappishFinland
        RT_ACCELERATOR0xac8a80x90dataSami LappishNorway
        RT_ACCELERATOR0xac8a80x90dataSami LappishSweden
        RT_ACCELERATOR0xac8000xa8dataSami LappishFinland
        RT_ACCELERATOR0xac8000xa8dataSami LappishNorway
        RT_ACCELERATOR0xac8000xa8dataSami LappishSweden
        RT_GROUP_CURSOR0xaca780x14data
        RT_GROUP_CURSOR0xadd580x30data
        RT_GROUP_ICON0xa00200x22dataSami LappishFinland
        RT_GROUP_ICON0xa00200x22dataSami LappishNorway
        RT_GROUP_ICON0xa00200x22dataSami LappishSweden
        RT_GROUP_ICON0xa68080x76dataSami LappishFinland
        RT_GROUP_ICON0xa68080x76dataSami LappishNorway
        RT_GROUP_ICON0xa68080x76dataSami LappishSweden
        RT_GROUP_ICON0xac7980x68dataSami LappishFinland
        RT_GROUP_ICON0xac7980x68dataSami LappishNorway
        RT_GROUP_ICON0xac7980x68dataSami LappishSweden
        RT_VERSION0xadd880x254data
        None0xac9380xadataSami LappishFinland
        None0xac9380xadataSami LappishNorway
        None0xac9380xadataSami LappishSweden
        DLLImport
        KERNEL32.dlllstrcmpA, FindFirstFileW, EnumCalendarInfoA, _llseek, WritePrivateProfileSectionA, GlobalLock, InterlockedCompareExchange, SleepEx, GetModuleHandleW, EnumCalendarInfoExW, EnumTimeFormatsW, WriteFileGather, EnumResourceTypesA, GlobalAlloc, GetSystemDirectoryW, AddRefActCtx, GetSystemWindowsDirectoryA, LeaveCriticalSection, GetConsoleAliasW, GetFileAttributesW, SetDefaultCommConfigA, GetCPInfoExW, SetLastError, GetProcAddress, CopyFileA, GetFirmwareEnvironmentVariableW, LoadLibraryA, OpenWaitableTimerW, FindFirstVolumeMountPointW, GetExitCodeThread, AddAtomW, CreateEventW, AddAtomA, FindNextFileW, GetShortPathNameW, SetCalendarInfoA, ReadConsoleInputW, LocalSize, CopyFileExA, RaiseException, PulseEvent, GetLastError, MoveFileA, DeleteFileA, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, HeapAlloc, EnterCriticalSection, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapCreate, HeapFree, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RtlUnwind, LoadLibraryW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringW, MultiByteToWideChar, GetStringTypeW, SetFilePointer, IsProcessorFeaturePresent, HeapSize, CloseHandle, WriteConsoleW, SetStdHandle, CreateFileW
        USER32.dllLoadMenuW
        ADVAPI32.dllLookupAccountSidW
        Language of compilation systemCountry where language is spokenMap
        Sami LappishFinland
        Sami LappishNorway
        Sami LappishSweden
        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
        192.168.2.562.173.142.5149680802033203 03/14/23-16:02:33.550566TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4968080192.168.2.562.173.142.51
        TimestampSource PortDest PortSource IPDest IP
        Mar 14, 2023 16:02:33.490955114 CET4968080192.168.2.562.173.142.51
        Mar 14, 2023 16:02:33.550028086 CET804968062.173.142.51192.168.2.5
        Mar 14, 2023 16:02:33.550132990 CET4968080192.168.2.562.173.142.51
        Mar 14, 2023 16:02:33.550565958 CET4968080192.168.2.562.173.142.51
        Mar 14, 2023 16:02:33.609353065 CET804968062.173.142.51192.168.2.5
        Mar 14, 2023 16:02:33.609383106 CET804968062.173.142.51192.168.2.5
        Mar 14, 2023 16:02:33.609524965 CET4968080192.168.2.562.173.142.51
        Mar 14, 2023 16:02:33.612766027 CET4968080192.168.2.562.173.142.51
        Mar 14, 2023 16:02:33.671506882 CET804968062.173.142.51192.168.2.5
        TimestampSource PortDest PortSource IPDest IP
        Mar 14, 2023 16:01:13.337074041 CET6132553192.168.2.58.8.8.8
        Mar 14, 2023 16:01:13.363226891 CET53613258.8.8.8192.168.2.5
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Mar 14, 2023 16:01:13.337074041 CET192.168.2.58.8.8.80xce38Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Mar 14, 2023 16:01:13.363226891 CET8.8.8.8192.168.2.50xce38Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
        • 62.173.142.51
        No statistics
        Target ID:0
        Start time:16:00:49
        Start date:14/03/2023
        Path:C:\Users\user\Desktop\server.exe
        Wow64 process (32bit):true
        Commandline:C:\Users\user\Desktop\server.exe
        Imagebase:0x400000
        File size:192000 bytes
        MD5 hash:8F092511C91BFC1F2516E420739A7967
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Yara matches:
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494639050.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494532027.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.580772569.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494557591.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494507047.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494595207.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494478374.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.580453253.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.580553464.00000000006A8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494674831.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.494622294.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        Reputation:low

        No disassembly