Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

EITyS0c1l1.exe

Status: finished
Submission Time: 2021-09-27 20:36:35 +02:00
Malicious
Trojan
Spyware
Vidar

Comments

Tags

  • ArkeiStealer
  • exe

Details

  • Analysis ID:
    491728
  • API (Web) ID:
    859292
  • Analysis Started:
    2021-09-27 20:48:27 +02:00
  • Analysis Finished:
    2021-09-27 20:58:31 +02:00
  • MD5:
    3c6a15ef43bcc9483d77bf2e12d5cc7f
  • SHA1:
    ad6a3befae15bffa77c5198b5e73c5c29a809f88
  • SHA256:
    393253379d5fef504e68d7cc55e722879837620623d6ec44ef23c69503d4c332
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 22/68
malicious
Score: 7/45

IPs

IP Country Detection
88.99.75.82
 Germany
23.88.105.196
 United States

Domains

Name IP Detection
mas.to
 88.99.75.82

URLs

Name Detection
https://mas.to/
https://mas.to/.well-known/webfinger?resource=acct%3Akillern0%40mas.to
http://23.88.105.196/msvcp140.dll
Click to see the 38 hidden entries
https://ac.ecosia.org/autocomplete?q=
https://mas.to/users/killern0/following
http://23.88.105.196/mozglue.dll
http://23.88.105.196/softokn3.dll
https://mas.to/avatars/original/missing.png
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://23.88.105.196/softokn3.dllBRp
http://23.88.105.196/vcruntime140.dll
https://mas.to/u
https://media.mas.to/masto-public/site_uploads/files/000/000/003/original/elephant_ui_plane-e3f2d57c
http://23.88.105.196/
https://duckduckgo.com/chrome_newtabSQLite
http://23.88.105.196/1013JFp
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://mas.to/users/killern0/followers
https://media.mas.to
https://mas.to/@killern0
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
http://www.mozilla.com0
https://duckduckgo.com/chrome_newtab
http://www.mozilla.com/en-US/blocklist/
http://23.88.105.196/vcruntime140.dllWJb
https://duckduckgo.com/ac/?q=
http://23.88.105.196/nss3.dll
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://23.88.105.196/1013
http://ocsp.thawte.com0
http://23.88.105.196/nss3.dll%D
https://duckduckgo.com/chrome_newtaba
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://23.88.105.196/freebl3.dll
https://mas.to
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
http://23.88.105.196/nss3.dll:D
https://mas.to/users/killern0
https://mas.to;
https://github.com/tootsuite/mastodon
https://joinmastodon.org/apps

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_f641b5c0feaa330592d853d41ed3946c467d7b6_02c23b36_175012bf\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_099b1ad3\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_0a42d899\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
Click to see the 43 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_1022a574\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_15ffd2b9\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_1622776e\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EITyS0c1l1.exe_a08665b74c114988f973f9b85f46df44be996dcb_02c23b36_16eb644f\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\mozglue.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mozglue[1].dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\freebl3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF970.tmp.dmp
 Mini DuMP crash report, 14 streams, Tue Sep 28 03:50:15 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF66D.tmp.dmp
 Mini DuMP crash report, 15 streams, Tue Sep 28 03:51:20 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3E8.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD09C.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC81.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB6.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC888.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\msvcp140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\ProgramData\nss3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\softokn3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\vcruntime140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA1BD.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vcruntime140[1].dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\softokn3[1].dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\freebl3[1].dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\msvcp140[1].dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nss3[1].dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6771.tmp.dmp
 Mini DuMP crash report, 14 streams, Tue Sep 28 03:49:35 2021, 0x1205a4 type
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\files\Cookies\Google Chrome_Default.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\files\Files\Default.zip
 Zip archive data (empty)
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\files\information.txt
 ISO-8859 text, with very long lines, with CRLF line terminators
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\files\screenshot.jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\files\temp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15C4.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E0A.tmp.dmp
 Mini DuMP crash report, 14 streams, Tue Sep 28 03:50:32 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D6D.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER553E.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC129.tmp.dmp
 Mini DuMP crash report, 14 streams, Tue Sep 28 03:50:00 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E19.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER70C9.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A5.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9893.tmp.dmp
 Mini DuMP crash report, 14 streams, Tue Sep 28 03:49:47 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F3B.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\M249TZVHLMI5PNLLM7MNY6V95\d06ed635-68f6-4e9a-955c-4899f5f57b9a6900922876.zip
 Zip archive data, at least v2.0 to extract
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB43.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4A2.tmp.dmp
 Mini DuMP crash report, 15 streams, Tue Sep 28 03:51:03 2021, 0x1205a4 type
 #