Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

18719D6856A09A622001F1C325067D56AFA63BD21FBAD.exe

Status: finished
Submission Time: 2022-01-14 13:48:17 +01:00
Malicious
Trojan
Spyware
Evader
AveMaria Oski Stealer Redline Clipper St

Comments

Tags

  • exe
  • OskiStealer

Details

  • Analysis ID:
    553216
  • API (Web) ID:
    920741
  • Analysis Started:
    2022-01-14 13:48:20 +01:00
  • Analysis Finished:
    2022-01-14 14:04:12 +01:00
  • MD5:
    39bfd2ce7cffeafc8f4d85d89fd6f072
  • SHA1:
    9d0df13ef8de579a2bbfba88e938a836ffab1069
  • SHA256:
    18719d6856a09a622001f1c325067d56afa63bd21fbad25fd23c01b2c0c67472
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 48/68
Open Full Report
malicious
Score: 14/32
malicious
Score: 21/28
malicious
malicious

IPs

IP Country Detection
108.167.165.140
 United States
208.95.112.1
 United States
149.154.167.220
 United Kingdom
Click to see the 2 hidden entries
185.199.108.133
 Netherlands
104.18.115.97
 United States

Domains

Name IP Detection
raw.githubusercontent.com
 185.199.108.133
ip-api.com
 208.95.112.1
pplonline.org
 108.167.165.140
Click to see the 3 hidden entries
api.telegram.org
 149.154.167.220
icanhazip.com
 104.18.115.97
201.75.14.0.in-addr.arpa
 0.0.0.0

URLs

Name Detection
http://pplonline.org/Cgi/
http://crl.globals
https://raw.githubusercontent.com/caxmd/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13.8/
Click to see the 68 hidden entries
http://pplonline.org/Cgi//1.jpg
https://api.telegram.orgx
https://raw.githubusercontent.com
http://pplonline.org/Cgi//1.jpgU
http://pplonline.org/Cgi//7.jpg
http://pplonline.org/Cgi//main.php
https://api.tele
https://java.sun.com
http://pplonline.org/Cgi//4.jpg
https://api.telegrP
https://raw.githubusercontent.com/caxmd/StormKitty/master/StormKitty/stub/packages/AnonFileApi.1.14.
https://raw.githubusercontent.com/caxmd/StormKitty/master/StormKitty/stub/packages/AnonFileApi.1.14.6/lib/net40/AnonFileApi.dll
http://pplonline.org/Cgi//2.jpg
http://ocsp.thawte.com0
http://ip-api.comV
http://pplonline.org/Cgi//5.jpg
http://www.mozilla.com0
http://pplonline.org/Cgi//3.jpg
http://icanhazip.comx
http://pplonline.org/Cgi//2.jpg2
http://pplonline.org/Cgi//6.jpg
aegismd.ca/cgi/
http://pplonline.org/Cgi//3.jpgK
https://raw.githubusercontent.com/caxmd/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.dll
http://ip-api.comx
http://upx.sf.net
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://www.mozilla.com/en-US/blocklist/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
https://ac.ecosia.org/autocomplete?q=
https://support.google.com/chrome/?p=plugin_shockwave
http://www.codeplex.com/DotNetZip
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
http://api.telegram.org
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://api.telegram.org/bot1456609378:AAEnBfmWHEJfWWOpiWK1aoQnqzDubVAn7J4/getMe
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
http://ip-api.com/line/?fields=hosting
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
https://duckduckgo.com/chrome_newtab
https://duckduckgo.com/ac/?q=
https://api.telegram.org
https://api.telegram.org/bot
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
https://support.google.com/chrome/answer/6258784
http://icanhazip.com/8
https://support.google.com/chrome/?p=plugin_flash
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
http://icanhazip.com/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
http://ip-api.com/line/?fields=h
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
http://crl.thawte.com/ThawteTimestampingCA.crl0
https://github.com/LimerBoy/StormKitty
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
http://ip-api.com
https://support.google.com/chrome/?p=plugin_divx
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
http://icanhazip.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Dropped files

Name File Type Hashes Detection
C:\ProgramData\AMD Driver\taskshell.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\svchoste.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\dll.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 45 hidden entries
C:\Users\user\AppData\Local\Temp\chormuimii.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\chormuim.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\18719D6856A09A622001F1C325067D56AFA63BD21FBAD.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\AnonFileApi.dll
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Videos.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Temp.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\Apps.txt
 ASCII text
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\Debug.txt
 UTF-8 Unicode text, with CRLF, LF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\Desktop.jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\Info.txt
 ASCII text
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\Process.txt
 ASCII text
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\System\ProductKey.txt
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chormuimii.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\DotNetZip.dll
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\StormKitty-Latest.log
 UTF-8 Unicode text, with CRLF, LF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp3B84.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp7B6F.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpD3BF.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpD6AE.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpEBCE.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpED36.tmp.dat
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Windows\appcompat\Programs\Amcache.hve
 MS Windows registry file, NT/2000 or above
 #
C:\ProgramData\nss3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\216363876181815\cookies\Google Chrome_Default.txt
 ASCII text, with CRLF line terminators
 #
C:\ProgramData\216363876181815\screenshot.jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
 #
C:\ProgramData\216363876181815\system.txt
 ISO-8859 text, with CRLF line terminators
 #
C:\ProgramData\216363876181815\temp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chormuim.exe_f835bf2b83f3c8457b2c9f23c56c3875f48489e0_b8655ec3_01487522\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5768.tmp.dmp
 Mini DuMP crash report, 16 streams, Fri Jan 14 21:49:59 2022, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER667D.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6804.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\freebl3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\mozglue.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\msvcp140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\ProgramData\216363876181815\_2163638761.zip
 Zip archive data, at least v2.0 to extract
 #
C:\ProgramData\softokn3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\sqlite3.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\ProgramData\vcruntime140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Browsers\Google\Cookies.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Desktop.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Documents.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Downloads.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\OneDrive.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Pictures.txt
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\632783881659e232750f71880779d5da\user@936905_en-US\Directories\Startup.txt
 ASCII text, with CRLF line terminators
 #