Malware analysis 66f0297e9c3eb_15[1].exe Malicious activity

Add for printing

File name:	66f0297e9c3eb_15[1].exe
Full analysis:	https://app.any.run/tasks/67495dfb-4833-4b7d-b70c-763e684be307
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware. Malware Trends Tracker >>>
Analysis date:	September 28, 2024, 10:05:10
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	netreactor evasion privateloader loader
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	38EF48A2E156067F1770497335E92066
SHA1:	304BCCCDFB486BF797D69F109F0B6FE64A94D945
SHA256:	88EFB8B6990E916E7590C2BD3F734F390F7C3D7B517A5FDC1BABA0A2F6FBD54C
SSDEEP:	98304:BvKPhaiAwZ8x4iOWVheFa4AUbQT6kzQTaHiKgO0G9XBizoc+83gUIbsxU4f8dEky:BsGqvkq64LDaH9UZA/Rvq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Connects to the CnC server
  - RegAsm.exe (PID: 5668)
- PRIVATELOADER has been detected (SURICATA)
  - RegAsm.exe (PID: 5668)
SUSPICIOUS
- Checks for external IP
  - svchost.exe (PID: 2256)
  - RegAsm.exe (PID: 5668)
- Potential Corporate Privacy Violation
  - RegAsm.exe (PID: 5668)
- Process requests binary or script from the Internet
  - RegAsm.exe (PID: 5668)
- Executable content was dropped or overwritten
  - RegAsm.exe (PID: 5668)
- Connects to the server without a host name
  - RegAsm.exe (PID: 5668)
INFO
- Checks supported languages
  - 66f0297e9c3eb_15[1].exe (PID: 3828)
- Reads the computer name
  - 66f0297e9c3eb_15[1].exe (PID: 3828)
- .NET Reactor protector has been detected
  - 66f0297e9c3eb_15[1].exe (PID: 3828)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (32.5)
.exe	\|	Win32 Executable MS Visual C++ (generic) (23.6)
.exe	\|	Win64 Executable (generic) (20.9)
.scr	\|	Windows screen saver (9.9)
.dll	\|	Win32 Dynamic Link Library (generic) (4.9)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2096:11:09 02:41:17+00:00
ImageFileCharacteristics:	Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	5421568
InitializedDataSize:	5637120
UninitializedDataSize:	-
EntryPoint:	0x52d9be
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	4.3.3.1
ProductVersionNumber:	4.3.3.1
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	GctdaT3mgl4
CompanyName:	P55mFjs8Lkl
FileDescription:	vitosoft
FileVersion:	4.3.3.1
InternalName:	vitosoft.exe
LegalCopyright:	0PeOsqH2g0hSv1o
LegalTrademarks:	-
OriginalFileName:	vitosoft.exe
ProductName:	gfgfgfg
ProductVersion:	4.3.3.1
AssemblyVersion:	6.6.1.2

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

130

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2256

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

3828

"C:\Users\admin\Desktop\66f0297e9c3eb_15[1].exe"

C:\Users\admin\Desktop\66f0297e9c3eb_15[1].exe

explorer.exe

User:

admin

Company:

P55mFjs8Lkl

Integrity Level:

MEDIUM

Description:

vitosoft

Exit code:

Version:

4.3.3.1

Modules

Images
c:\users\admin\desktop\66f0297e9c3eb_15[1].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

5632

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

5668

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

66f0297e9c3eb_15[1].exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft .NET Assembly Registration Utility

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

7116

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

Add for printing

Total events

993

Read events

990

Write events

Delete events

Modification events


(PID) Process:	(5668) RegAsm.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(5668) RegAsm.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(5668) RegAsm.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
5668	RegAsm.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12		binary
		MD5:7FB5FA1534DCF77F2125B2403B30A0EE	SHA256:33A39E9EC2133230533A686EC43760026E014A3828C703707ACBC150FE40FD6F
5668	RegAsm.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8		binary
		MD5:971C514F84BBA0785F80AA1C23EDFD79	SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
5668	RegAsm.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8		binary
		MD5:A8E7BC3775A4E30C4479234B29BBE749	SHA256:CB2F72558EC2233CD4FDBA5075D0302FFE3CB9BD142CA203F7AC76E9D2A16F8A
5668	RegAsm.exe	C:\Users\admin\Documents\iofolko5\_PQYP4UXvoH5ZBIVGFr62AES.exe		executable
		MD5:FE9A74E5D7A8EB7C09EBFFC6F6A6128B	SHA256:0989916204259770D65679BDB4F7DD28F4CC04D74128812A1FEC111E13448FE6
5668	RegAsm.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12		binary
		MD5:790F76FB9A314E10D7616A9B5337C0B0	SHA256:1F35ADAC6BDAAD8CC3E6E167706A46968737B9D544108D3FA2AA088C5B9FA235
5668	RegAsm.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\66f517a571881_lyla3344[1].exe		executable
		MD5:FE9A74E5D7A8EB7C09EBFFC6F6A6128B	SHA256:0989916204259770D65679BDB4F7DD28F4CC04D74128812A1FEC111E13448FE6
5668	RegAsm.exe	C:\Users\admin\Documents\iofolko5\XHnbwrxmXsObZZFpPaKMCpsb.exe		html
		MD5:35924DD67BA2C8EDA41F3E773513010F	SHA256:B04D924E89D4DEF3FFD519D51614BC4C47A3D1816D1007CEC2C0B68382378FCA
5668	RegAsm.exe	C:\Users\admin\Documents\iofolko5\hBw5EH_GyGbrkqUM1ZMEb3wh.exe		text
		MD5:C965AA525AE4CFBC3B45C6B7E9271A59	SHA256:50EA6C698E72E13B8132B66BBCA9479B7F4815EBB2F8ADB3CA1CFEC79523107E
5668	RegAsm.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\66f75fe05b7f9_vsaf15[1].htm		html
		MD5:35924DD67BA2C8EDA41F3E773513010F	SHA256:B04D924E89D4DEF3FFD519D51614BC4C47A3D1816D1007CEC2C0B68382378FCA
5668	RegAsm.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\66f75fd9dc673_vasd[1].htm		html
		MD5:AE5B189C6D83B438452A994689D16A64	SHA256:450035507F488AFB34DE327198E270AD7CAD14938AEB16181F164012377EC49E

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5668	RegAsm.exe	HEAD	200	147.45.44.104:80	http://147.45.44.104/lopsa/66f18e5598f87_kaloa.exe	unknown	—	—	unknown
5668	RegAsm.exe	GET	200	147.45.44.104:80	http://147.45.44.104/yuop/66f517a571881_lyla3344.exe#lyla3344	unknown	—	—	unknown
5668	RegAsm.exe	GET	200	194.116.215.195:80	http://194.116.215.195/xin.exe	unknown	—	—	unknown
5668	RegAsm.exe	HEAD	200	176.113.115.33:80	http://176.113.115.33/thebig/noode.exe	unknown	—	—	unknown
5668	RegAsm.exe	HEAD	200	185.215.113.202:80	http://185.215.113.202/dima/doza.exe	unknown	—	—	unknown
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
240	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
240	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
5668	RegAsm.exe	GET	200	45.91.200.135:80	http://45.91.200.135/api/wp-ping.php	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
6588	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
—	—	20.190.160.20:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	40.113.110.67:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	23.218.210.69:443	go.microsoft.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 51.104.136.2	whitelisted
www.microsoft.com	184.30.21.171 88.221.169.152	whitelisted
google.com	142.250.184.206	whitelisted
login.live.com	20.190.160.20 40.126.32.76 40.126.32.74 40.126.32.133 20.190.160.17 40.126.32.138 40.126.32.140 40.126.32.136 20.190.159.68 40.126.31.71 40.126.31.69 20.190.159.64 20.190.159.2 20.190.159.0 40.126.31.73 20.190.159.75	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
go.microsoft.com	23.218.210.69	whitelisted
browser.pipe.aria.microsoft.com	20.189.173.18	whitelisted
arc.msn.com	20.223.36.55	whitelisted
fd.api.iris.microsoft.com	20.223.35.26	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
5668	RegAsm.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
5668	RegAsm.exe	Device Retrieving External IP Address Detected	ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
2256	svchost.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
5668	RegAsm.exe	Device Retrieving External IP Address Detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
5668	RegAsm.exe	A Network Trojan was detected	LOADER [ANY.RUN] PrivateLoader Check-in
5668	RegAsm.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
5668	RegAsm.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
5668	RegAsm.exe	Potentially Bad Traffic	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
5668	RegAsm.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

66f0297e9c3eb_15[1].exe

38EF48A2E156067F1770497335E92066

304BCCCDFB486BF797D69F109F0B6FE64A94D945

88EFB8B6990E916E7590C2BD3F734F390F7C3D7B517A5FDC1BABA0A2F6FBD54C

98304:BvKPhaiAwZ8x4iOWVheFa4AUbQT6kzQTaHiKgO0G9XBizoc+83gUIbsxU4f8dEky:BsGqvkq64LDaH9UZA/Rvq

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Connects to the CnC server

PRIVATELOADER has been detected (SURICATA)

SUSPICIOUS

Checks for external IP

Potential Corporate Privacy Violation

Process requests binary or script from the Internet

Executable content was dropped or overwritten

Connects to the server without a host name

INFO

Checks supported languages

Reads the computer name

.NET Reactor protector has been detected

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings