Windows Analysis Report
SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe

Overview

General Information

Sample name: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Analysis ID: 1433539
MD5: a8f5eb653b660a24e0a0017c684c1b96
SHA1: 4b75c2c8dba5f4198873a8ed0e0c4d2bf146d881
SHA256: d4d4c8f1217f38de76b3ba26865db8460987a0877ba70eb70f25fef6f5756c51
Tags: exe
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Sample uses string decryption to hide its real strings
Uses dynamic DNS services
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["dav12221.duckdns.org"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}
Sample uses string decryption to hide its real strings
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: dav12221.duckdns.org
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: 7000
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: <123456789>
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: <Xwormmm>
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: XWorm V5.2
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack String decryptor: USB.exe
Uses 32bit PE files
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdbH source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Configuration.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb0 source: WER6A45.tmp.dmp.7.dr
Source: Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.pdb` source: WER6A45.tmp.dmp.7.dr
Source: Binary string: o.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: Accessibility.pdbP source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2062955260.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000001041000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Drawing.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb4 source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Core.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb{ft source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000001041000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.PDB source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: o0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: dav12221.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: dav12221.duckdns.org
Yara detected Generic Downloader
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 207.32.218.48:7000
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: 1GSERVERSUS 1GSERVERSUS
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: dav12221.duckdns.org

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, XLogger.cs .Net Code: KeyboardLayout

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000001.00000002.3319035853.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2061672625.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Code function: 0_2_01A5AA28 0_2_01A5AA28
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Code function: 0_2_01A59150 0_2_01A59150
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Code function: 1_2_0136E83C 1_2_0136E83C
One or more processes crash
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1304
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2059950940.000000000150E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2062955260.0000000005B10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061672625.0000000005910000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameExample.dll0 vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061548987.00000000044D5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameExample.dll0 vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000000.2057100989.00000000010A0000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamedccw.exel% vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319035853.000000000040C000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3322576781.0000000005379000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Binary or memory string: OriginalFilenamedccw.exel% vs SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe
Uses 32bit PE files
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000001.00000002.3319035853.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2061672625.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.raw.unpack, DarkListView.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.raw.unpack, DarkListView.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5910000.4.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.450c590.3.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/4@2/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Mutant created: \Sessions\1\BaseNamedObjects\VnoSv30JNEHEbKof
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4696
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7327edff-e120-410d-918e-17ee65893590 Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1304
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdbH source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Configuration.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb0 source: WER6A45.tmp.dmp.7.dr
Source: Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.pdb` source: WER6A45.tmp.dmp.7.dr
Source: Binary string: o.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: Accessibility.pdbP source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2062955260.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000001041000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Drawing.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb4 source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.Core.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb{ft source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000001041000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.PDB source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER6A45.tmp.dmp.7.dr
Source: Binary string: System.ni.pdb source: WER6A45.tmp.dmp.7.dr
Source: Binary string: o0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3323026235.00000000058BA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdbRSDS source: WER6A45.tmp.dmp.7.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs .Net Code: Memory
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Static PE information: 0x91B6DABA [Thu Jun 20 21:44:26 2047 UTC]
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe PID: 2680, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 1A10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 34D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 3240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 1310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 2C60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: 4C60000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Window / User API: threadDelayed 466 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Window / User API: threadDelayed 9520 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe TID: 4276 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe TID: 6024 Thread sleep count: 466 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe TID: 6024 Thread sleep time: -466000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe TID: 6024 Thread sleep count: 9520 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe TID: 6024 Thread sleep time: -9520000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe, 00000001.00000002.3319877443.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5b10000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5b10000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.5b10000.5.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, Messages.cs Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, XLogger.cs Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.3319035853.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe PID: 2680, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe PID: 4696, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 1.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.35bd948.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34e1e04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe.34df5c4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.3319035853.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2061389020.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe PID: 2680, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe PID: 4696, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1433539 Sample: SecuriteInfo.com.MSIL.Krypt... Startdate: 29/04/2024 Architecture: WINDOWS Score: 100 16 dav12221.duckdns.org 2->16 20 Found malware configuration 2->20 22 Malicious sample detected (through community Yara rule) 2->22 24 Yara detected XWorm 2->24 28 8 other signatures 2->28 8 SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe 3 2->8         started        signatures3 26 Uses dynamic DNS services 16->26 process4 signatures5 30 Injects a PE file into a foreign processes 8->30 11 SecuriteInfo.com.MSIL.Kryptik.ALLD.tr.8114.2947.exe 2 8->11         started        process6 dnsIp7 18 dav12221.duckdns.org 207.32.218.48, 7000 1GSERVERSUS United States 11->18 14 WerFault.exe 19 12 11->14         started        process8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
207.32.218.48
 dav12221.duckdns.org United States
14315 1GSERVERSUS true

Contacted Domains

Name IP Active
dav12221.duckdns.org 207.32.218.48 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
dav12221.duckdns.org true
  • Avira URL Cloud: safe
 unknown