Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
server_(3).exe

Overview

General Information

Sample Name:server_(3).exe
Analysis ID:830450
MD5:aa37b36ea7ba39b6c00ae1b01bada3f7
SHA1:90545746e5b23fcdf7db1fa5c30588df2f4c31bf
SHA256:a6886a3566a1a98072d67f1aca4a04b5667f97f4df21b2f54d6108293d7c02b7
Tags:agenziaentrateexegoziisfbITAmefmiseursnif
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Yara detected Ursnif
Detected unpacking (changes PE section rights)
Snort IDS alert for network traffic
Writes or reads registry keys via WMI
Found API chain indicative of debugger detection
Machine Learning detection for sample
Found evasive API chain (may stop execution after checking system information)
Writes registry values via WMI
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

  • System is w10x64
  • server_(3).exe (PID: 1236 cmdline: C:\Users\user\Desktop\server_(3).exe MD5: AA37B36EA7BA39B6C00AE1B01BADA3F7)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Gozi, Ursnif2000 Ursnif aka Snifula2006 Gozi v1.0, Gozi CRM, CRM, Papras2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)-> 2010 Gozi Prinimalka -> Vawtrak/NeverquestIn 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.gozi
{"RSA Public Key": "ScCjtIu/chsReaToemavuPsGfYIczuvCBclhySG8/AhfUJMnvau4hmaBPIAXScUh9/secJMcCpqd5yeayd2fJdEc3ETZJfeY55SskXGIyxmn6sJL8WH2YF95GitV+tnd52epRBd8/snxdFtGg4Pgf9kxQsW/ySpD96hQxlGzGgDApS0E54E54SLEBTqihX3FWN2//mDaDIJuoFz7lt0whvCg/8gXPBf/s2nkXoRwyyqXguvwDcw9IZEu1NT1qqIwpXL9DGldaMvwfXTGOLIkQX35RsJJDpP1V5Mcgc+c1nBRPKqGQz+NUtKDBiyp0RXMK3jDdMGWvimLl80kvMkvSd8fQXtWRcZ7DCuQwrQxkXo=", "c2_domain": ["checklist.skype.com", "62.173.142.81", "193.233.175.113", "109.248.11.184", "212.109.218.26", "185.68.93.7"], "botnet": "7715", "server": "50", "serpent_key": "xeaLJj1BwSDpjIfH", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
SourceRuleDescriptionAuthorStrings
00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0x1228:$a1: /C ping localhost -n %u && del "%s"
    • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xa9c:$a5: filename="%.4u.%lu"
    • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe6d:$a9: &whoami=%s
    • 0xe56:$a10: %u.%u_%u_%u_x%u
    • 0xd63:$a11: size=%u&hash=0x%08x
    • 0xb1d:$a12: &uptime=%u
    • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
    • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
    00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
      • 0x1228:$a1: /C ping localhost -n %u && del "%s"
      • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
      • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
      • 0xa9c:$a5: filename="%.4u.%lu"
      • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
      • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xe6d:$a9: &whoami=%s
      • 0xe56:$a10: %u.%u_%u_%u_x%u
      • 0xd63:$a11: size=%u&hash=0x%08x
      • 0xb1d:$a12: &uptime=%u
      • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
      • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
      Click to see the 27 entries
      No Sigma rule has matched
      Timestamp:192.168.2.462.173.142.8149695802033204 03/20/23-11:48:17.902010
      SID:2033204
      Source Port:49695
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.462.173.142.8149695802033203 03/20/23-11:48:17.902010
      SID:2033203
      Source Port:49695
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: server_(3).exeReversingLabs: Detection: 38%
      Source: server_(3).exeVirustotal: Detection: 37%Perma Link
      Source: server_(3).exeJoe Sandbox ML: detected
      Source: 0.2.server_(3).exe.400000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen7
      Source: 00000000.00000002.580746978.0000000002729000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "ScCjtIu/chsReaToemavuPsGfYIczuvCBclhySG8/AhfUJMnvau4hmaBPIAXScUh9/secJMcCpqd5yeayd2fJdEc3ETZJfeY55SskXGIyxmn6sJL8WH2YF95GitV+tnd52epRBd8/snxdFtGg4Pgf9kxQsW/ySpD96hQxlGzGgDApS0E54E54SLEBTqihX3FWN2//mDaDIJuoFz7lt0whvCg/8gXPBf/s2nkXoRwyyqXguvwDcw9IZEu1NT1qqIwpXL9DGldaMvwfXTGOLIkQX35RsJJDpP1V5Mcgc+c1nBRPKqGQz+NUtKDBiyp0RXMK3jDdMGWvimLl80kvMkvSd8fQXtWRcZ7DCuQwrQxkXo=", "c2_domain": ["checklist.skype.com", "62.173.142.81", "193.233.175.113", "109.248.11.184", "212.109.218.26", "185.68.93.7"], "botnet": "7715", "server": "50", "serpent_key": "xeaLJj1BwSDpjIfH", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

      Compliance

      barindex
      Source: C:\Users\user\Desktop\server_(3).exeUnpacked PE file: 0.2.server_(3).exe.400000.0.unpack
      Source: server_(3).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: C:\Users\user\Desktop\server_(3).exeFile opened: C:\Windows\SysWOW64\msvcr100.dll

      Networking

      barindex
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.4:49695 -> 62.173.142.81:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.4:49695 -> 62.173.142.81:80
      Source: Joe Sandbox ViewASN Name: SPACENET-ASInternetServiceProviderRU SPACENET-ASInternetServiceProviderRU
      Source: global trafficHTTP traffic detected: GET /drew/l9wdesHCBL/WcUH_2Fe6cEC19JMx/ojSec9BNMFM6/V8tDDFde77O/U9i1cqxDkO368R/9gNBIEzgy6mBOfdpOkxLi/yTSQzU5LkHeJ3ST8/wg2AtPFgVdoBaEt/6J4T7kNNoupXFHQTJc/6wx_2FfTi/ip9uaIqtLaRaENmKe5lk/gWcrKu3HuxIt5fBBNoX/csBNoK1ie3PBW5Bt5sLiYK/wkK58GrNqzGj0/jf15aQpx/17gepP_2BoXbW_2FEP_2BQC/qQ5KGV_2Fv/ErJyFWv8XjZRosjau/Q6z6usxdqA4/_2FeDY.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 62.173.142.81Connection: Keep-AliveCache-Control: no-cache
      Source: unknownDNS traffic detected: query: checklist.skype.com replaycode: Name error (3)
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.81
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.81
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.81
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.81
      Source: unknownTCP traffic detected without corresponding DNS query: 62.173.142.81
      Source: server_(3).exe, 00000000.00000002.580737497.000000000238C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://62.173
      Source: unknownDNS traffic detected: queries for: checklist.skype.com
      Source: global trafficHTTP traffic detected: GET /drew/l9wdesHCBL/WcUH_2Fe6cEC19JMx/ojSec9BNMFM6/V8tDDFde77O/U9i1cqxDkO368R/9gNBIEzgy6mBOfdpOkxLi/yTSQzU5LkHeJ3ST8/wg2AtPFgVdoBaEt/6J4T7kNNoupXFHQTJc/6wx_2FfTi/ip9uaIqtLaRaENmKe5lk/gWcrKu3HuxIt5fBBNoX/csBNoK1ie3PBW5Bt5sLiYK/wkK58GrNqzGj0/jf15aQpx/17gepP_2BoXbW_2FEP_2BQC/qQ5KGV_2Fv/ErJyFWv8XjZRosjau/Q6z6usxdqA4/_2FeDY.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 62.173.142.81Connection: Keep-AliveCache-Control: no-cache

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Source: Yara matchFile source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTR

      E-Banking Fraud

      barindex
      Source: Yara matchFile source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTR
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

      System Summary

      barindex
      Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.580647391.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
      Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.580571515.00000000004D6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
      Source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: C:\Users\user\Desktop\server_(3).exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Users\user\Desktop\server_(3).exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: server_(3).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.580647391.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
      Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.580571515.00000000004D6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
      Source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E16DF
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E832C
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E1D8A
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_0040110B GetProcAddress,NtCreateSection,memset,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_00401459 NtMapViewOfSection,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_004019F1 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E8551 NtQueryVirtualMemory,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005C1C58 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,CreateThread,QueueUserAPC,GetLastError,TerminateThread,SetLastError,WaitForSingleObject,GetExitCodeThread,GetLastError,GetLastError,
      Source: server_(3).exeReversingLabs: Detection: 38%
      Source: server_(3).exeVirustotal: Detection: 37%
      Source: server_(3).exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\server_(3).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\server_(3).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
      Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@1/1
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E30D5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,
      Source: C:\Users\user\Desktop\server_(3).exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server_(3).exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\server_(3).exeFile opened: C:\Windows\SysWOW64\msvcr100.dll

      Data Obfuscation

      barindex
      Source: C:\Users\user\Desktop\server_(3).exeUnpacked PE file: 0.2.server_(3).exe.400000.0.unpack
      Source: C:\Users\user\Desktop\server_(3).exeUnpacked PE file: 0.2.server_(3).exe.400000.0.unpack .text:ER;.data:W;.wuke:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E831B push ecx; ret
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E7F30 push ecx; ret
      Source: server_(3).exeStatic PE information: section name: .wuke
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: Yara matchFile source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTR
      Source: C:\Users\user\Desktop\server_(3).exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\server_(3).exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Source: C:\Users\user\Desktop\server_(3).exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
      Source: C:\Users\user\Desktop\server_(3).exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
      Source: C:\Users\user\Desktop\server_(3).exeAPI call chain: ExitProcess graph end node

      Anti Debugging

      barindex
      Source: C:\Users\user\Desktop\server_(3).exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_00401000 LoadLibraryA,GetProcAddress,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005C092B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005C0D90 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\server_(3).exeCode function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,CreateThread,QueueUserAPC,GetLastError,TerminateThread,SetLastError,WaitForSingleObject,GetExitCodeThread,GetLastError,GetLastError,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E3BD3 cpuid
      Source: C:\Users\user\Desktop\server_(3).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_004015B0 GetSystemTimeAsFileTime,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_00401D68 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,
      Source: C:\Users\user\Desktop\server_(3).exeCode function: 0_2_005E3BD3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: server_(3).exe PID: 1236, type: MEMORYSTR
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts2
      Windows Management Instrumentation
      Path InterceptionPath Interception1
      Virtualization/Sandbox Evasion
      OS Credential Dumping1
      System Time Discovery
      Remote Services11
      Archive Collected Data
      Exfiltration Over Other Network Medium2
      Encrypted Channel
      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      Data Encrypted for Impact
      Default Accounts12
      Native API
      Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
      Obfuscated Files or Information
      LSASS Memory1
      Security Software Discovery
      Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
      Ingress Tool Transfer
      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)21
      Software Packing
      Security Account Manager1
      Virtualization/Sandbox Evasion
      SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
      Non-Application Layer Protocol
      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
      Process Discovery
      Distributed Component Object ModelInput CaptureScheduled Transfer12
      Application Layer Protocol
      SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
      Account Discovery
      SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain Credentials1
      System Owner/User Discovery
      VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync1
      Remote System Discovery
      Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem124
      System Information Discovery
      Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      server_(3).exe38%ReversingLabsWin32.Ransomware.LockbitCrypt
      server_(3).exe38%VirustotalBrowse
      server_(3).exe100%Joe Sandbox ML
      No Antivirus matches
      SourceDetectionScannerLabelLinkDownload
      0.2.server_(3).exe.5e0000.2.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.server_(3).exe.400000.0.unpack100%AviraTR/Crypt.XPACK.Gen7Download File
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://62.173.142.81/drew/l9wdesHCBL/WcUH_2Fe6cEC19JMx/ojSec9BNMFM6/V8tDDFde77O/U9i1cqxDkO368R/9gNBIEzgy6mBOfdpOkxLi/yTSQzU5LkHeJ3ST8/wg2AtPFgVdoBaEt/6J4T7kNNoupXFHQTJc/6wx_2FfTi/ip9uaIqtLaRaENmKe5lk/gWcrKu3HuxIt5fBBNoX/csBNoK1ie3PBW5Bt5sLiYK/wkK58GrNqzGj0/jf15aQpx/17gepP_2BoXbW_2FEP_2BQC/qQ5KGV_2Fv/ErJyFWv8XjZRosjau/Q6z6usxdqA4/_2FeDY.jlk0%Avira URL Cloudsafe
      http://62.1730%Avira URL Cloudsafe
      http://62.1730%VirustotalBrowse
      NameIPActiveMaliciousAntivirus DetectionReputation
      checklist.skype.com
      unknown
      unknownfalse
        high
        NameMaliciousAntivirus DetectionReputation
        http://62.173.142.81/drew/l9wdesHCBL/WcUH_2Fe6cEC19JMx/ojSec9BNMFM6/V8tDDFde77O/U9i1cqxDkO368R/9gNBIEzgy6mBOfdpOkxLi/yTSQzU5LkHeJ3ST8/wg2AtPFgVdoBaEt/6J4T7kNNoupXFHQTJc/6wx_2FfTi/ip9uaIqtLaRaENmKe5lk/gWcrKu3HuxIt5fBBNoX/csBNoK1ie3PBW5Bt5sLiYK/wkK58GrNqzGj0/jf15aQpx/17gepP_2BoXbW_2FEP_2BQC/qQ5KGV_2Fv/ErJyFWv8XjZRosjau/Q6z6usxdqA4/_2FeDY.jlktrue
        • Avira URL Cloud: safe
        unknown
        NameSourceMaliciousAntivirus DetectionReputation
        http://62.173server_(3).exe, 00000000.00000002.580737497.000000000238C000.00000004.00000010.00020000.00000000.sdmpfalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        low
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        62.173.142.81
        unknownRussian Federation
        34300SPACENET-ASInternetServiceProviderRUtrue
        Joe Sandbox Version:37.0.0 Beryl
        Analysis ID:830450
        Start date and time:2023-03-20 11:45:24 +01:00
        Joe Sandbox Product:CloudBasic
        Overall analysis duration:0h 5m 33s
        Hypervisor based Inspection enabled:false
        Report type:light
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
        Number of analysed new started processes analysed:7
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • HDC enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample file name:server_(3).exe
        Detection:MAL
        Classification:mal100.troj.evad.winEXE@1/0@1/1
        EGA Information:
        • Successful, ratio: 100%
        HDC Information:
        • Successful, ratio: 71.9% (good quality ratio 69.9%)
        • Quality average: 82%
        • Quality standard deviation: 26.5%
        HCA Information:
        • Successful, ratio: 98%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        No simulations
        No context
        No context
        No context
        No context
        No context
        No created / dropped files found
        File type:PE32 executable (GUI) Intel 80386, for MS Windows
        Entropy (8bit):6.797824417239488
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.96%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:server_(3).exe
        File size:181760
        MD5:aa37b36ea7ba39b6c00ae1b01bada3f7
        SHA1:90545746e5b23fcdf7db1fa5c30588df2f4c31bf
        SHA256:a6886a3566a1a98072d67f1aca4a04b5667f97f4df21b2f54d6108293d7c02b7
        SHA512:1a3d446ab096e25b840c442356169333e10db16baa24d9f5842eddad4b8303dba3957310e1ba8545ebbb5379b7b1f84c3ca2957d3d29cd8ea85f014a9abe0772
        SSDEEP:3072:sKUXgTGIAmez+JQAxHun7YB5ahAWlS5UQjV:0gTfBfxAkBSAP5
        TLSH:C7049EC35390BC51E4158A3A8E2FC2F4AB4DFC51CE58AB66F3086E2F4CBC162D5A6751
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.Q.f.Q.f.Q...Q.f.Q..4Q.f.Q...Q.f.Q..9Q.f.Q.f.Q.f.Q...Q.f.Q..0Q.f.Q..7Q.f.QRich.f.Q........PE..L.....eb...................
        Icon Hash:ba824246a5a2a29a
        Entrypoint:0x402f11
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x400000
        Subsystem:windows gui
        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
        DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x626505B2 [Sun Apr 24 08:09:22 2022 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:5
        OS Version Minor:1
        File Version Major:5
        File Version Minor:1
        Subsystem Version Major:5
        Subsystem Version Minor:1
        Import Hash:0c16d61a145a6038e0c4acd3e1db8764
        Instruction
        call 00007F62A4AE81C0h
        jmp 00007F62A4AE57EEh
        mov eax, 0040D008h
        ret
        mov eax, dword ptr [0049D720h]
        push esi
        push 00000014h
        pop esi
        test eax, eax
        jne 00007F62A4AE5969h
        mov eax, 00000200h
        jmp 00007F62A4AE5968h
        cmp eax, esi
        jnl 00007F62A4AE5969h
        mov eax, esi
        mov dword ptr [0049D720h], eax
        push 00000004h
        push eax
        call 00007F62A4AE826Eh
        pop ecx
        pop ecx
        mov dword ptr [0049C700h], eax
        test eax, eax
        jne 00007F62A4AE5980h
        push 00000004h
        push esi
        mov dword ptr [0049D720h], esi
        call 00007F62A4AE8255h
        pop ecx
        pop ecx
        mov dword ptr [0049C700h], eax
        test eax, eax
        jne 00007F62A4AE5967h
        push 0000001Ah
        pop eax
        pop esi
        ret
        xor edx, edx
        mov ecx, 0040D008h
        jmp 00007F62A4AE5967h
        mov eax, dword ptr [0049C700h]
        mov dword ptr [edx+eax], ecx
        add ecx, 20h
        add edx, 04h
        cmp ecx, 0040D288h
        jl 00007F62A4AE594Ch
        push FFFFFFFEh
        pop esi
        xor edx, edx
        mov ecx, 0040D018h
        push edi
        mov eax, edx
        sar eax, 05h
        mov eax, dword ptr [0049C600h+eax*4]
        mov edi, edx
        and edi, 1Fh
        shl edi, 06h
        mov eax, dword ptr [edi+eax]
        cmp eax, FFFFFFFFh
        je 00007F62A4AE596Ah
        cmp eax, esi
        je 00007F62A4AE5966h
        test eax, eax
        jne 00007F62A4AE5964h
        mov dword ptr [ecx], esi
        add ecx, 20h
        inc edx
        cmp ecx, 0040D078h
        jl 00007F62A4AE5930h
        pop edi
        xor eax, eax
        pop esi
        ret
        call 00007F62A4AE5F76h
        cmp byte ptr [00000000h], 00000000h
        Programming Language:
        • [C++] VS2010 build 30319
        • [ASM] VS2010 build 30319
        • [ C ] VS2010 build 30319
        • [IMP] VS2008 SP1 build 30729
        • [RES] VS2010 build 30319
        • [LNK] VS2010 build 30319
        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0xb7fc0x3c.text
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x9f0000xdaf0.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2ae80x40.text
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x10000x19c.text
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000xb1440xb200False0.513232970505618data6.0109927875042635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .data0xd0000x9072c0x13200False0.946142258986928data7.852935841663951IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .wuke0x9e0000x960x200False0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rsrc0x9f0000xdaf00xdc00False0.4132634943181818data4.473611819780319IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        NameRVASizeTypeLanguageCountry
        AFX_DIALOG_LAYOUT0xab5980x2data
        TONIZITOHOWAPEVUMOBEM0xaaea00x598ASCII text, with very long lines (1432), with no line terminatorsSami LappishFinland
        TONIZITOHOWAPEVUMOBEM0xaaea00x598ASCII text, with very long lines (1432), with no line terminatorsSami LappishNorway
        TONIZITOHOWAPEVUMOBEM0xaaea00x598ASCII text, with very long lines (1432), with no line terminatorsSami LappishSweden
        RT_CURSOR0xab5a00x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
        RT_CURSOR0xab6d00xf0Device independent bitmap graphic, 24 x 48 x 1, image size 0
        RT_CURSOR0xab7c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
        RT_ICON0x9f6800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishFinland
        RT_ICON0x9f6800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishNorway
        RT_ICON0x9f6800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishSweden
        RT_ICON0x9ff280x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishFinland
        RT_ICON0x9ff280x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishNorway
        RT_ICON0x9ff280x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishSweden
        RT_ICON0xa0ff80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishFinland
        RT_ICON0xa0ff80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishNorway
        RT_ICON0xa0ff80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0Sami LappishSweden
        RT_ICON0xa18a00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishFinland
        RT_ICON0xa18a00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishNorway
        RT_ICON0xa18a00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishSweden
        RT_ICON0xa3e480x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishFinland
        RT_ICON0xa3e480x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishNorway
        RT_ICON0xa3e480x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishSweden
        RT_ICON0xa4f200xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishFinland
        RT_ICON0xa4f200xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishNorway
        RT_ICON0xa4f200xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0Sami LappishSweden
        RT_ICON0xa5dc80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishFinland
        RT_ICON0xa5dc80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishNorway
        RT_ICON0xa5dc80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0Sami LappishSweden
        RT_ICON0xa64900x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishFinland
        RT_ICON0xa64900x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishNorway
        RT_ICON0xa64900x568Device independent bitmap graphic, 16 x 32 x 8, image size 0Sami LappishSweden
        RT_ICON0xa69f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishFinland
        RT_ICON0xa69f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishNorway
        RT_ICON0xa69f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0Sami LappishSweden
        RT_ICON0xa8fa00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishFinland
        RT_ICON0xa8fa00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishNorway
        RT_ICON0xa8fa00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0Sami LappishSweden
        RT_ICON0xaa0480x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishFinland
        RT_ICON0xaa0480x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishNorway
        RT_ICON0xaa0480x988Device independent bitmap graphic, 24 x 48 x 32, image size 0Sami LappishSweden
        RT_ICON0xaa9d00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishFinland
        RT_ICON0xaa9d00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishNorway
        RT_ICON0xaa9d00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0Sami LappishSweden
        RT_ACCELERATOR0xab4e00x78dataSami LappishFinland
        RT_ACCELERATOR0xab4e00x78dataSami LappishNorway
        RT_ACCELERATOR0xab4e00x78dataSami LappishSweden
        RT_ACCELERATOR0xab4380xa8dataSami LappishFinland
        RT_ACCELERATOR0xab4380xa8dataSami LappishNorway
        RT_ACCELERATOR0xab4380xa8dataSami LappishSweden
        RT_GROUP_CURSOR0xac8680x30data
        RT_GROUP_ICON0xa4ef00x30dataSami LappishFinland
        RT_GROUP_ICON0xa4ef00x30dataSami LappishNorway
        RT_GROUP_ICON0xa4ef00x30dataSami LappishSweden
        RT_GROUP_ICON0xa0fd00x22dataSami LappishFinland
        RT_GROUP_ICON0xa0fd00x22dataSami LappishNorway
        RT_GROUP_ICON0xa0fd00x22dataSami LappishSweden
        RT_GROUP_ICON0xaae380x68dataSami LappishFinland
        RT_GROUP_ICON0xaae380x68dataSami LappishNorway
        RT_GROUP_ICON0xaae380x68dataSami LappishSweden
        RT_VERSION0xac8980x258data
        None0xab5580xadataSami LappishFinland
        None0xab5580xadataSami LappishNorway
        None0xab5580xadataSami LappishSweden
        None0xab5680xadataSami LappishFinland
        None0xab5680xadataSami LappishNorway
        None0xab5680xadataSami LappishSweden
        None0xab5780xadataSami LappishFinland
        None0xab5780xadataSami LappishNorway
        None0xab5780xadataSami LappishSweden
        None0xab5880xadataSami LappishFinland
        None0xab5880xadataSami LappishNorway
        None0xab5880xadataSami LappishSweden
        DLLImport
        KERNEL32.dllPulseEvent, SetDefaultCommConfigA, FindFirstFileW, EnumCalendarInfoA, _llseek, GetConsoleAliasA, GetCurrentProcess, InterlockedCompareExchange, SleepEx, GetWindowsDirectoryA, EnumTimeFormatsW, WriteFileGather, EnumResourceTypesA, ActivateActCtx, GlobalAlloc, GetFirmwareEnvironmentVariableA, LoadLibraryW, Sleep, ReadConsoleInputA, LeaveCriticalSection, GetFileAttributesW, WritePrivateProfileSectionW, TerminateProcess, IsDBCSLeadByte, lstrcmpW, GlobalUnlock, RaiseException, SetLastError, GetProcAddress, GlobalGetAtomNameA, OpenWaitableTimerA, AddAtomA, FindFirstVolumeMountPointA, GetModuleHandleA, FindNextFileW, GetShortPathNameW, GetCPInfoExA, SetCalendarInfoA, ReadConsoleInputW, DeleteFileW, EnumCalendarInfoExA, LocalFree, CopyFileExA, GetLastError, DeleteFileA, GetCommandLineA, HeapSetInformation, GetStartupInfoW, EnterCriticalSection, SetFilePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, GetModuleHandleW, ExitProcess, WriteFile, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapFree, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, HeapReAlloc, WriteConsoleW, MultiByteToWideChar, IsProcessorFeaturePresent, LCMapStringW, GetStringTypeW, HeapSize, CloseHandle, CreateFileW
        USER32.dllLoadMenuA
        Language of compilation systemCountry where language is spokenMap
        Sami LappishFinland
        Sami LappishNorway
        Sami LappishSweden
        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
        192.168.2.462.173.142.8149695802033204 03/20/23-11:48:17.902010TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4969580192.168.2.462.173.142.81
        192.168.2.462.173.142.8149695802033203 03/20/23-11:48:17.902010TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969580192.168.2.462.173.142.81
        TimestampSource PortDest PortSource IPDest IP
        Mar 20, 2023 11:48:17.838356972 CET4969580192.168.2.462.173.142.81
        Mar 20, 2023 11:48:17.901516914 CET804969562.173.142.81192.168.2.4
        Mar 20, 2023 11:48:17.901694059 CET4969580192.168.2.462.173.142.81
        Mar 20, 2023 11:48:17.902009964 CET4969580192.168.2.462.173.142.81
        Mar 20, 2023 11:48:17.964943886 CET804969562.173.142.81192.168.2.4
        Mar 20, 2023 11:48:17.966471910 CET804969562.173.142.81192.168.2.4
        Mar 20, 2023 11:48:17.966608047 CET4969580192.168.2.462.173.142.81
        Mar 20, 2023 11:48:17.968391895 CET4969580192.168.2.462.173.142.81
        Mar 20, 2023 11:48:18.031224966 CET804969562.173.142.81192.168.2.4
        TimestampSource PortDest PortSource IPDest IP
        Mar 20, 2023 11:46:57.667893887 CET5657253192.168.2.48.8.8.8
        Mar 20, 2023 11:46:57.699767113 CET53565728.8.8.8192.168.2.4
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Mar 20, 2023 11:46:57.667893887 CET192.168.2.48.8.8.80x7302Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Mar 20, 2023 11:46:57.699767113 CET8.8.8.8192.168.2.40x7302Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
        • 62.173.142.81
        No statistics
        Target ID:0
        Start time:11:46:22
        Start date:20/03/2023
        Path:C:\Users\user\Desktop\server_(3).exe
        Wow64 process (32bit):true
        Commandline:C:\Users\user\Desktop\server_(3).exe
        Imagebase:0x400000
        File size:181760 bytes
        MD5 hash:AA37B36EA7BA39B6C00AE1B01BADA3F7
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Yara matches:
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514574237.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514378176.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514450320.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.580647391.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514589845.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514416763.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514479802.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514505620.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.580765376.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
        • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.514528355.0000000002BC8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.580571515.00000000004D6000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
        Reputation:low

        No disassembly