Windows Analysis Report
KR6CT3hIxT.exe

Overview

General Information

Sample name: KR6CT3hIxT.exe
renamed because original name is a hash value
Original sample name: 5c95d5493dda877b228a6485a6d40d9c.exe
Analysis ID: 1447590
MD5: 5c95d5493dda877b228a6485a6d40d9c
SHA1: 185482dabc06787f6ce14c6cd46c17372a1b77ae
SHA256: fdb5b2a0041b0939552ecd31e382e28529313c8bc8a656eb7de1cef9fbd6eee9
Tags: 64exetrojan
Infos:

Detection

RedLine, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Yara detected XWorm
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Name Description Attribution Blogpost URLs Link
XWorm Malware with wide range of capabilities ranging from RAT to ransomware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\3.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\r.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Found malware configuration
Source: 00000002.00000002.4157787084.0000000003381000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["195.2.75.12"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Source: 7.2.r.exe.e10000.0.unpack Malware Configuration Extractor: RedLine {"C2 url": ["195.2.75.12:54762"], "Bot Id": "cheat"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\3.exe ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\3.exe Virustotal: Detection: 55% Perma Link
Source: C:\Users\user\AppData\Local\Temp\4.exe ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\4.exe Virustotal: Detection: 43% Perma Link
Source: C:\Users\user\AppData\Local\Temp\r.exe ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\r.exe Virustotal: Detection: 52% Perma Link
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Virustotal: Detection: 35% Perma Link
Multi AV Scanner detection for submitted file
Source: KR6CT3hIxT.exe ReversingLabs: Detection: 36%
Source: KR6CT3hIxT.exe Virustotal: Detection: 55% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\r.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: KR6CT3hIxT.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 2.2.3.exe.f10000.0.unpack String decryptor: 195.2.75.12
Source: 2.2.3.exe.f10000.0.unpack String decryptor: 7000
Source: 2.2.3.exe.f10000.0.unpack String decryptor: <123456789>
Source: 2.2.3.exe.f10000.0.unpack String decryptor: <Xwormmm>
Source: 2.2.3.exe.f10000.0.unpack String decryptor: XWorm V5.6
Source: 2.2.3.exe.f10000.0.unpack String decryptor: USB.exe
Source: KR6CT3hIxT.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 00000001.00000000.1688378562.0000000000B94000.00000002.00000001.01000000.00000009.sdmp, 4.exe, 00000001.00000002.1703408526.0000000000B94000.00000002.00000001.01000000.00000009.sdmp, rdegje.exe, 00000006.00000002.1948042720.0000000000F04000.00000002.00000001.01000000.0000000C.sdmp, rdegje.exe, 00000006.00000000.1938407320.0000000000F04000.00000002.00000001.01000000.0000000C.sdmp, rdegje.exe.2.dr, 4.exe.0.dr
Source: Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb. source: winrar-x64-701.exe.0.dr
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: KR6CT3hIxT.exe
Source: Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 3.exe, 00000002.00000002.4149852444.0000000000F20000.00000040.00000001.01000000.0000000A.sdmp, r.exe, 00000007.00000002.2159322752.0000000000E30000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701.exe.0.dr
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DDB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DDB190
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DC40BC
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DEFCA0 FindFirstFileExA, 0_2_00007FF7E1DEFCA0
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B6BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 1_2_00B6BA94
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B7D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 1_2_00B7D420
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EDBA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 6_2_00EDBA94
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EED420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 6_2_00EED420

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 195.2.75.12
Source: Malware configuration extractor URLs: 195.2.75.12:54762
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49730 -> 195.2.75.12:7000
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 195.2.75.12:54762Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 195.2.75.12:54762Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 195.2.75.12:54762Content-Length: 930799Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 195.2.75.12:54762Content-Length: 930791Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VDSINA-ASRU VDSINA-ASRU
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: unknown TCP traffic detected without corresponding DNS query: 195.2.75.12
Source: global traffic DNS traffic detected: DNS query: api.ip.sb
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 195.2.75.12:54762Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: r.exe, 00000007.00000002.2165535966.0000000003C52000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003BB6000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://195.2.75.12:54762
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://195.2.75.12:54762/
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: r.exe, 00000007.00000002.2159196933.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.adp/1.0/
Source: r.exe, 00000007.00000002.2159196933.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ns.microsofo/1.2/
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: r.exe, 00000007.00000002.2165535966.0000000003BB6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: r.exe, 00000007.00000002.2165535966.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 3.exe, 00000002.00000002.4157787084.0000000003381000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: r.exe, 00000007.00000002.2165535966.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/0
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: r.exe, 00000007.00000002.2165535966.0000000003C52000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003ACA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: r.exe, 00000007.00000002.2165535966.0000000003BB6000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: r.exe, 00000007.00000002.2165535966.0000000003A51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: winrar-x64-701.exe.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: r.exe, 00000007.00000002.2165535966.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb
Source: r.exe String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE
Source: r.exe, r.exe, 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: r.exe String found in binary or memory: https://api.ipify.orgcookies//setti
Source: r.exe, r.exe, 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: r.exe, r.exe, 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: r.exe, 00000007.00000002.2178396624.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000007.00000002.2178396624.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, tmp626E.tmp.7.dr, tmp625D.tmp.7.dr, tmp2BF9.tmp.7.dr, tmp6280.tmp.7.dr, tmp2BD7.tmp.7.dr, tmp2BE8.tmp.7.dr, tmp626F.tmp.7.dr, tmp62B2.tmp.7.dr, tmp2C09.tmp.7.dr, tmp6290.tmp.7.dr, tmp624D.tmp.7.dr, tmp62A1.tmp.7.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.3.exe.f10000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.4149652457.0000000000F12000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: r.exe PID: 7776, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
PE file contains section with special chars
Source: 3.exe.1.dr Static PE information: section name:
Source: r.exe.6.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\3.exe Process Stats: CPU usage > 49%
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DBC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DBC2F0
Detected potential crypto function
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DDB190 0_2_00007FF7E1DDB190
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCA4AC 0_2_00007FF7E1DCA4AC
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD3484 0_2_00007FF7E1DD3484
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE0754 0_2_00007FF7E1DE0754
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DBF930 0_2_00007FF7E1DBF930
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC4928 0_2_00007FF7E1DC4928
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DDCE88 0_2_00007FF7E1DDCE88
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DB5E24 0_2_00007FF7E1DB5E24
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD1F20 0_2_00007FF7E1DD1F20
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DBA310 0_2_00007FF7E1DBA310
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DBC2F0 0_2_00007FF7E1DBC2F0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DB7288 0_2_00007FF7E1DB7288
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC126C 0_2_00007FF7E1DC126C
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD21D0 0_2_00007FF7E1DD21D0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCF180 0_2_00007FF7E1DCF180
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD53F0 0_2_00007FF7E1DD53F0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DB76C0 0_2_00007FF7E1DB76C0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF2550 0_2_00007FF7E1DF2550
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCB534 0_2_00007FF7E1DCB534
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DB4840 0_2_00007FF7E1DB4840
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DEC838 0_2_00007FF7E1DEC838
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF5AF8 0_2_00007FF7E1DF5AF8
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DB1AA4 0_2_00007FF7E1DB1AA4
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD2AB0 0_2_00007FF7E1DD2AB0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DEFA94 0_2_00007FF7E1DEFA94
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC1A48 0_2_00007FF7E1DC1A48
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE89A0 0_2_00007FF7E1DE89A0
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD3964 0_2_00007FF7E1DD3964
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCC96C 0_2_00007FF7E1DCC96C
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE8C1C 0_2_00007FF7E1DE8C1C
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD4B98 0_2_00007FF7E1DD4B98
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCBB90 0_2_00007FF7E1DCBB90
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC5B60 0_2_00007FF7E1DC5B60
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD8DF4 0_2_00007FF7E1DD8DF4
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE0754 0_2_00007FF7E1DE0754
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD2D58 0_2_00007FF7E1DD2D58
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF2080 0_2_00007FF7E1DF2080
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DCAF18 0_2_00007FF7E1DCAF18
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B692C6 1_2_00B692C6
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B77DDC 1_2_00B77DDC
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B75011 1_2_00B75011
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B862A8 1_2_00B862A8
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B75282 1_2_00B75282
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B702F7 1_2_00B702F7
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B78253 1_2_00B78253
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B713FD 1_2_00B713FD
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B864D7 1_2_00B864D7
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B7742E 1_2_00B7742E
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B755B0 1_2_00B755B0
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B8E600 1_2_00B8E600
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B707A7 1_2_00B707A7
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B788AF 1_2_00B788AF
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B6D833 1_2_00B6D833
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B6395A 1_2_00B6395A
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B8EAAE 1_2_00B8EAAE
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B64A8E 1_2_00B64A8E
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B92BB4 1_2_00B92BB4
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B6FCCC 1_2_00B6FCCC
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B62EB6 1_2_00B62EB6
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DE6348 2_2_00DE6348
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DE84B8 2_2_00DE84B8
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DE5670 2_2_00DE5670
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DEAC10 2_2_00DEAC10
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DE5328 2_2_00DE5328
Source: C:\Users\user\AppData\Local\Temp\3.exe Code function: 2_2_00DE0BA0 2_2_00DE0BA0
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00ED92C6 6_2_00ED92C6
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE7DDC 6_2_00EE7DDC
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE5011 6_2_00EE5011
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE02F7 6_2_00EE02F7
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF62A8 6_2_00EF62A8
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE5282 6_2_00EE5282
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE8253 6_2_00EE8253
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE13FD 6_2_00EE13FD
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF64D7 6_2_00EF64D7
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE742E 6_2_00EE742E
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE55B0 6_2_00EE55B0
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EFE600 6_2_00EFE600
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE07A7 6_2_00EE07A7
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EE88AF 6_2_00EE88AF
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EDD833 6_2_00EDD833
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00ED395A 6_2_00ED395A
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EFEAAE 6_2_00EFEAAE
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00ED4A8E 6_2_00ED4A8E
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00F02BB4 6_2_00F02BB4
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EDFCCC 6_2_00EDFCCC
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00ED2EB6 6_2_00ED2EB6
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_01B5E7B0 7_2_01B5E7B0
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_01B5DC90 7_2_01B5DC90
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FD4468 7_2_06FD4468
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FD9628 7_2_06FD9628
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FD1210 7_2_06FD1210
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FD3320 7_2_06FD3320
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FDDD00 7_2_06FDDD00
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FDD108 7_2_06FDD108
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: String function: 00EEFEFC appears 42 times
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: String function: 00EF07A0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: String function: 00EEFFD0 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: String function: 00B7FEFC appears 42 times
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: String function: 00B807A0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: String function: 00B7FFD0 appears 56 times
Yara signature match
Source: 2.2.3.exe.f10000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.4149652457.0000000000F12000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: r.exe PID: 7776, type: MEMORYSTR Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 3.exe.1.dr Static PE information: Section: ZLIB complexity 1.0007113755416155
Source: r.exe.6.dr Static PE information: Section: ZLIB complexity 0.9971846443824112
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@10/48@1/1
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DBB6D8 GetLastError,FormatMessageW,LocalFree, 0_2_00007FF7E1DBB6D8
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DD8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_00007FF7E1DD8624
Source: C:\Users\user\AppData\Local\Temp\r.exe File created: C:\Users\user\AppData\Local\Yandex Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\3.exe Mutant created: \Sessions\1\BaseNamedObjects\DPO5yNZvebP2C4hf
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5080953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Command line argument: sfxname 1_2_00B7F05C
Source: C:\Users\user\AppData\Local\Temp\4.exe Command line argument: sfxstime 1_2_00B7F05C
Source: C:\Users\user\AppData\Local\Temp\4.exe Command line argument: STARTDLG 1_2_00B7F05C
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Command line argument: sfxname 6_2_00EEF05C
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Command line argument: sfxstime 6_2_00EEF05C
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Command line argument: STARTDLG 6_2_00EEF05C
Source: KR6CT3hIxT.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: r.exe, 00000007.00000002.2165535966.0000000003C75000.00000004.00000800.00020000.00000000.sdmp, tmp2BB4.tmp.7.dr, tmp2BA3.tmp.7.dr, tmp2BD6.tmp.7.dr, tmpF502.tmp.7.dr, tmp2BC6.tmp.7.dr, tmp2BC5.tmp.7.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: KR6CT3hIxT.exe ReversingLabs: Detection: 36%
Source: KR6CT3hIxT.exe Virustotal: Detection: 55%
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File read: C:\Users\user\Desktop\KR6CT3hIxT.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\KR6CT3hIxT.exe "C:\Users\user\Desktop\KR6CT3hIxT.exe"
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Process created: C:\Users\user\AppData\Local\Temp\4.exe "C:\Users\user\AppData\Local\Temp\4.exe"
Source: C:\Users\user\AppData\Local\Temp\4.exe Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe"
Source: C:\Users\user\AppData\Local\Temp\3.exe Process created: C:\Users\user\AppData\Local\Temp\rdegje.exe "C:\Users\user\AppData\Local\Temp\rdegje.exe"
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Process created: C:\Users\user\AppData\Local\Temp\r.exe "C:\Users\user\AppData\Local\Temp\r.exe"
Source: C:\Users\user\AppData\Local\Temp\r.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Process created: C:\Users\user\AppData\Local\Temp\4.exe "C:\Users\user\AppData\Local\Temp\4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process created: C:\Users\user\AppData\Local\Temp\rdegje.exe "C:\Users\user\AppData\Local\Temp\rdegje.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Process created: C:\Users\user\AppData\Local\Temp\r.exe "C:\Users\user\AppData\Local\Temp\r.exe" Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: KR6CT3hIxT.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: KR6CT3hIxT.exe Static file information: File size 7616416 > 1048576
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: KR6CT3hIxT.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: KR6CT3hIxT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 00000001.00000000.1688378562.0000000000B94000.00000002.00000001.01000000.00000009.sdmp, 4.exe, 00000001.00000002.1703408526.0000000000B94000.00000002.00000001.01000000.00000009.sdmp, rdegje.exe, 00000006.00000002.1948042720.0000000000F04000.00000002.00000001.01000000.0000000C.sdmp, rdegje.exe, 00000006.00000000.1938407320.0000000000F04000.00000002.00000001.01000000.0000000C.sdmp, rdegje.exe.2.dr, 4.exe.0.dr
Source: Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb. source: winrar-x64-701.exe.0.dr
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: KR6CT3hIxT.exe
Source: Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 3.exe, 00000002.00000002.4149852444.0000000000F20000.00000040.00000001.01000000.0000000A.sdmp, r.exe, 00000007.00000002.2159322752.0000000000E30000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-701.exe.0.dr
Source: KR6CT3hIxT.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KR6CT3hIxT.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KR6CT3hIxT.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KR6CT3hIxT.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KR6CT3hIxT.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\3.exe Unpacked PE file: 2.2.3.exe.f10000.0.unpack :ER;.rsrc:R;.reloc:R;.imports:W;.themida:EW;.boot:ER; vs :ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\r.exe Unpacked PE file: 7.2.r.exe.e10000.0.unpack :ER;.rsrc:R;.reloc:R;.imports:W;.themida:EW;.boot:ER; vs :ER;.rsrc:R;
Binary contains a suspicious time stamp
Source: r.exe.6.dr Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .boot
File is packed with WinRar
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5080953 Jump to behavior
PE file contains sections with non-standard names
Source: KR6CT3hIxT.exe Static PE information: section name: .didat
Source: KR6CT3hIxT.exe Static PE information: section name: _RDATA
Source: 4.exe.0.dr Static PE information: section name: .didat
Source: winrar-x64-701.exe.0.dr Static PE information: section name: .didat
Source: winrar-x64-701.exe.0.dr Static PE information: section name: _RDATA
Source: 3.exe.1.dr Static PE information: section name:
Source: 3.exe.1.dr Static PE information: section name: .imports
Source: 3.exe.1.dr Static PE information: section name: .themida
Source: 3.exe.1.dr Static PE information: section name: .boot
Source: rdegje.exe.2.dr Static PE information: section name: .didat
Source: r.exe.6.dr Static PE information: section name:
Source: r.exe.6.dr Static PE information: section name: .imports
Source: r.exe.6.dr Static PE information: section name: .themida
Source: r.exe.6.dr Static PE information: section name: .boot
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF5166 push rsi; retf 0_2_00007FF7E1DF5167
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF5156 push rsi; retf 0_2_00007FF7E1DF5157
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B807F0 push ecx; ret 1_2_00B80803
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B7FEFC push eax; ret 1_2_00B7FF1A
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF07F0 push ecx; ret 6_2_00EF0803
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EEFEFC push eax; ret 6_2_00EEFF1A
Source: C:\Users\user\AppData\Local\Temp\r.exe Code function: 7_2_06FDE5C0 push es; ret 7_2_06FDE5D0
Source: 3.exe.1.dr Static PE information: section name: entropy: 7.961502728073197
Source: r.exe.6.dr Static PE information: section name: entropy: 7.975061725537987
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\3.exe File created: C:\Users\user\AppData\Local\Temp\rdegje.exe Jump to dropped file
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File created: C:\Users\user\AppData\Local\Temp\4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4.exe File created: C:\Users\user\AppData\Local\Temp\3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe File created: C:\Users\user\AppData\Local\Temp\r.exe Jump to dropped file
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe File created: C:\Users\user\AppData\Local\Temp\winrar-x64-701.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window searched: window name: Regmonclass Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 54762
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 54762 -> 49740
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\3.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\3.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\AppData\Local\Temp\3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: DE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 3380000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 31C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 66A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 76A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 77D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 87D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 66A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 76A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 8A30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 9A30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: AA30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: BA30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: BEF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: CEF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 66A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 76A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 86A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 96A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 76A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 86A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 86A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: A6A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 7440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: 8440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Memory allocated: 1B50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Memory allocated: 3A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Memory allocated: 3870000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\r.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\3.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\3.exe Window / User API: threadDelayed 9749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window / User API: threadDelayed 4942 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Window / User API: threadDelayed 4367 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\winrar-x64-701.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 7504 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 7516 Thread sleep count: 100 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 7516 Thread sleep count: 9749 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe TID: 7996 Thread sleep time: -31359464925306218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe TID: 7928 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe TID: 7952 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DDB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DDB190
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DC40BC
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DEFCA0 FindFirstFileExA, 0_2_00007FF7E1DEFCA0
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B6BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 1_2_00B6BA94
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B7D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 1_2_00B7D420
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EDBA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 6_2_00EDBA94
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EED420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 6_2_00EED420
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE16A4 VirtualQuery,GetSystemInfo, 0_2_00007FF7E1DE16A4
Source: C:\Users\user\AppData\Local\Temp\3.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 4.exe, 00000001.00000002.1703118557.00000000008D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 3.exe, 00000002.00000002.4145534188.0000000000594000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: r.exe, 00000007.00000002.2164011988.00000000017DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: 3.exe, 00000002.00000002.4145534188.0000000000594000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkflo
Source: C:\Users\user\AppData\Local\Temp\4.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\3.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\3.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\r.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process queried: DebugObjectHandle Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7E1DE3170
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B891B0 mov eax, dword ptr fs:[00000030h] 1_2_00B891B0
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF91B0 mov eax, dword ptr fs:[00000030h] 6_2_00EF91B0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF0D20 GetProcessHeap, 0_2_00007FF7E1DF0D20
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\3.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7E1DE3170
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF7E1DE2510
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE3354 SetUnhandledExceptionFilter, 0_2_00007FF7E1DE3354
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF7E1DE76D8
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B80A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00B80A0A
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B80B9D SetUnhandledExceptionFilter, 1_2_00B80B9D
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B80D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00B80D8A
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: 1_2_00B84FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00B84FEF
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF0A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00EF0A0A
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF0B9D SetUnhandledExceptionFilter, 6_2_00EF0B9D
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF0D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_00EF0D8A
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: 6_2_00EF4FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00EF4FEF
Source: C:\Users\user\AppData\Local\Temp\3.exe Memory allocated: page read and write | page guard Jump to behavior
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DDB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DDB190
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Process created: C:\Users\user\AppData\Local\Temp\4.exe "C:\Users\user\AppData\Local\Temp\4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4.exe Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Process created: C:\Users\user\AppData\Local\Temp\rdegje.exe "C:\Users\user\AppData\Local\Temp\rdegje.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Process created: C:\Users\user\AppData\Local\Temp\r.exe "C:\Users\user\AppData\Local\Temp\r.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DF58E0 cpuid 0_2_00007FF7E1DF58E0
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_00007FF7E1DDA2CC
Source: C:\Users\user\AppData\Local\Temp\4.exe Code function: GetLocaleInfoW,GetNumberFormatW, 1_2_00B7C093
Source: C:\Users\user\AppData\Local\Temp\rdegje.exe Code function: GetLocaleInfoW,GetNumberFormatW, 6_2_00EEC093
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\3.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DE0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF7E1DE0754
Source: C:\Users\user\Desktop\KR6CT3hIxT.exe Code function: 0_2_00007FF7E1DC51A4 GetVersionExW, 0_2_00007FF7E1DC51A4
Source: C:\Users\user\AppData\Local\Temp\3.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: r.exe, 00000007.00000002.2183831567.0000000006EF2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\3.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\r.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: r.exe PID: 7776, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 2.2.3.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4149652457.0000000000F12000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4157787084.0000000003381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3.exe PID: 7308, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\atomic\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\Guarda\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\r.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: r.exe PID: 7776, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.r.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2159289645.0000000000E12000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: r.exe PID: 7776, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 2.2.3.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4149652457.0000000000F12000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4157787084.0000000003381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3.exe PID: 7308, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447590 Sample: KR6CT3hIxT.exe Startdate: 26/05/2024 Architecture: WINDOWS Score: 100 42 api.ip.sb 2->42 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 8 other signatures 2->52 11 KR6CT3hIxT.exe 1 9 2->11         started        signatures3 process4 file5 36 C:\Users\user\AppData\...\winrar-x64-701.exe, PE32+ 11->36 dropped 38 C:\Users\user\AppData\Local\Temp\4.exe, PE32 11->38 dropped 14 4.exe 8 11->14         started        process6 file7 40 C:\Users\user\AppData\Local\Temp\3.exe, PE32 14->40 dropped 74 Multi AV Scanner detection for dropped file 14->74 76 Machine Learning detection for dropped file 14->76 18 3.exe 4 14->18         started        signatures8 process9 dnsIp10 44 195.2.75.12, 49730, 7000 VDSINA-ASRU Russian Federation 18->44 32 C:\Users\user\AppData\Local\Temp\rdegje.exe, PE32 18->32 dropped 54 Antivirus detection for dropped file 18->54 56 Multi AV Scanner detection for dropped file 18->56 58 Detected unpacking (changes PE section rights) 18->58 60 6 other signatures 18->60 23 rdegje.exe 8 18->23         started        file11 signatures12 process13 file14 34 C:\Users\user\AppData\Local\Temp\r.exe, PE32 23->34 dropped 62 Multi AV Scanner detection for dropped file 23->62 64 Machine Learning detection for dropped file 23->64 27 r.exe 15 48 23->27         started        signatures15 process16 signatures17 66 Antivirus detection for dropped file 27->66 68 Multi AV Scanner detection for dropped file 27->68 70 Detected unpacking (changes PE section rights) 27->70 72 10 other signatures 27->72 30 conhost.exe 27->30         started        process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
195.2.75.12
 unknown Russian Federation
48282 VDSINA-ASRU true

Contacted Domains

Name IP Active
api.ip.sb unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
195.2.75.12 true
  • Avira URL Cloud: safe
 unknown
195.2.75.12:54762 true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://195.2.75.12:54762/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown