1bf6d14c4b5f59aa30882f4aa25e9e9d703dac905a785fe020ff667600e5fc97

Submit
Reports

Overview

overview

Static

static

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

ฺฺฺ�...ฺฺ

windows10_x64

Analysis

max time kernel
283s
max time network
302s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 15:58

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

Behavioral task

behavioral1

Sample

1.bin/1.bin.exe

Resource

win10v20201028

agenttesla danabot dharma formbook gozi_rm3 qakbot 86920224 spx129 1590734339 agilenet banker botnet coreentity cryptone evasion keylogger packer persistence ransomware rat rezer0 spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

2019-09-02_22-41-10.exe

Resource

win10v20201028

smokeloader backdoor trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

31.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

3DMark 11 Advanced Edition.exe

Resource

win10v20201028

azorult plugx redline smokeloader tofsee vidar xmrig new_year_btc backdoor bootkit discovery evasion infostealer macro miner persistence spyware stealer trojan upx vmprotect xlm

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

Archive.zip__ccacaxs2tbz2t6ob3e.exe

Resource

win10v20201028

discovery persistence spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

CVE-2018-15982_PoC.swf

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

CVWSHSetup[1].bin/WSHSetup[1].exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

DiskInternals_Uneraser_v5_keygen.exe

Resource

win10v20201028

azorult discovery evasion infostealer persistence spyware stealer trojan upx

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

ForceOp 2.8.7 - By RaiSence.exe

Resource

win10v20201028

dcrat infostealer rat

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

HYDRA.exe

Resource

win10v20201028

smokeloader backdoor persistence trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

Keygen.exe

Resource

win10v20201028

asyncrat azorult modiloader oski raccoon remcos 5e4db353b88c002ba6466c06437973619aad03b3 discovery evasion infostealer persistence rat spyware stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe

Resource

win10v20201028

discovery persistence spyware stealer upx vmprotect

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

LtHv0O2KZDK4M637.exe

Resource

win10v20201028

azorult rms xmrig aspackv2 discovery evasion infostealer miner persistence rat spyware stealer trojan upx

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

OnlineInstaller.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe

Resource

win10v20201028

azorult bootkit evasion infostealer macro persistence spyware stealer trojan upx xlm

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe

Resource

win10v20201028

azorult plugx redline smokeloader vidar new_year_btc backdoor bootkit discovery evasion infostealer macro persistence spyware stealer trojan upx xlm

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

VyprVPN.exe

Resource

win10v20201028

persistence spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

WSHSetup[1].exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

api.exe

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

good.exe

Resource

win10v20201028

phorphiex evasion loader persistence trojan upx worm

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

infected dot net installer.exe

Resource

win10v20201028

persistence

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

update.exe

Resource

win10v20201028

azorult redline rms xmrig aspackv2 discovery evasion infostealer miner persistence rat spyware stealer trojan upx

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

vir1.xls

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

xNet.dll

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

api.exe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
880	api.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	908	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
880	api.exe

Processes

C:\Users\Admin\AppData\Local\Temp\api.exe
"C:\Users\Admin\AppData\Local\Temp\api.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:880

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads