Edit tour

Windows Analysis Report
tlw8Vv1OPD

Overview

General Information

Sample name:	tlw8Vv1OPD renamed because original name is a hash value
Original sample name:	3393068eec5540b5a987e0c31c601b6d77ec326fcda7d6ddaf62d0d4f9f6db65
Analysis ID:	1390949
MD5:	82f3539d8578b18fbc931f4f33fcbba3
SHA1:	196f127502d898e7d14cf9521b2b5838a2c1aa14
SHA256:	3393068eec5540b5a987e0c31c601b6d77ec326fcda7d6ddaf62d0d4f9f6db65

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Detected VMProtect packer

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Entry point lies outside standard sections

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Tries to load missing DLLs

Classification

Process Tree

System is w10x64_ra

tlw8Vv1OPD.exe (PID: 4776 cmdline: C:\Users\user\Desktop\tlw8Vv1OPD.exe MD5: 82F3539D8578B18FBC931F4F33FCBBA3)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: tlw8Vv1OPD

ReversingLabs: Detection: 84%

Source: tlw8Vv1OPD

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

System Summary

Detected VMProtect packer

Source: tlw8Vv1OPD

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Section loaded: umpdc.dll

Source: classification engine

Classification label: mal64.evad.win@1/0@0/0

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: tlw8Vv1OPD

ReversingLabs: Detection: 84%

Source: tlw8Vv1OPD

Static file information: File size 6196824 > 1048576

Source: tlw8Vv1OPD

Static PE information: Raw size of .vmp2 is bigger than: 0x100000 < 0x5c5c00

Source: tlw8Vv1OPD

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp2

Source: tlw8Vv1OPD

Static PE information: real checksum: 0x5d6a1d should be: 0x5f4e61

Source: tlw8Vv1OPD	Static PE information: section name: .vmp0
Source: tlw8Vv1OPD	Static PE information: section name: .symtab
Source: tlw8Vv1OPD	Static PE information: section name: .vmp1
Source: tlw8Vv1OPD	Static PE information: section name: .vmp2

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Memory written: PID: 4776 base: 7FFF4F430008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Memory written: PID: 4776 base: 7FFF4F2CD9F0 value: E9 20 26 16 00

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 000000000196178D second address: 0000000001961792 instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 pop esp 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F0BEC89Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F0DC9867h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 000000000135C7D7 second address: 000000000135C7DC instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 pop esp 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 00000000012B9F90 second address: 00000000012B9F94 instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 pop esi 0x00000004 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F14C4BACh 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F16A1B77h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F06EBC2Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F08C8BF7h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F1A1337Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F1BF0347h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F0C1181Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F0DEE7E7h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F1A07E3Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F1BE4E07h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F1A18E9Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F1BF5E67h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F1A1137Ch 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F1BEE347h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F0BDD1CCh 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F0DBA197h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F14C4EACh 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F16A1E77h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc
Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe	RDTSC instruction interceptor: First address: 0000000001A6B9E7 second address: 0000000001A7F934 instructions: 0x00000000 rdtsc 0x00000002 cmc 0x00000003 popfd 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc bp 0x00000008 mov edx, ecx 0x0000000a dec ecx 0x0000000b arpl dx, bx 0x0000000d pop edx 0x0000000e dec ecx 0x0000000f movzx ebp, ax 0x00000012 inc ecx 0x00000013 not al 0x00000015 pop eax 0x00000016 dec esp 0x00000017 movzx ecx, bx 0x0000001a inc ecx 0x0000001b pop esi 0x0000001c inc ecx 0x0000001d xchg cl, bh 0x0000001f jmp 00007FA0F0BD67BCh 0x00000024 inc ecx 0x00000025 pop ebx 0x00000026 inc eax 0x00000027 not ch 0x00000029 dec esp 0x0000002a movzx edx, di 0x0000002d inc esp 0x0000002e movzx eax, ax 0x00000031 inc ecx 0x00000032 pop ecx 0x00000033 movzx bp, bl 0x00000037 inc ebp 0x00000038 movzx edx, bx 0x0000003b dec eax 0x0000003c movzx ebx, sp 0x0000003f inc ecx 0x00000040 pop eax 0x00000041 pop edi 0x00000042 pop ecx 0x00000043 inc cx 0x00000045 movsx ebp, ah 0x00000048 dec eax 0x00000049 bswap ebp 0x0000004b inc ecx 0x0000004c not edx 0x0000004e pop ebx 0x0000004f mov ebp, 393B192Eh 0x00000054 inc bp 0x00000056 movsx edx, bl 0x00000059 pop ebp 0x0000005a inc ecx 0x0000005b pop edx 0x0000005c jmp 00007FA0F0DB3787h 0x00000061 ret 0x00000062 popfd 0x00000063 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe

Special instruction interceptor: First address: 0000000001A7F934 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\tlw8Vv1OPD.exe

Process information queried: ProcessInformation

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	1 Credential API Hooking	2 Security Software Discovery	Remote Services	1 Credential API Hooking	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	21 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tlw8Vv1OPD	84%	ReversingLabs	Win64.Infostealer.ClipBanker

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
teams-9999.teams-msedge.net	52.113.196.254	true	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1390949
Start date and time:	2024-02-12 17:19:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	tlw8Vv1OPD renamed because original name is a hash value
Original Sample Name:	3393068eec5540b5a987e0c31c601b6d77ec326fcda7d6ddaf62d0d4f9f6db65
Detection:	MAL
Classification:	mal64.evad.win@1/0@0/0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, login.live.com, teams-ring.msedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: tlw8Vv1OPD

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.918065443689799
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	tlw8Vv1OPD
File size:	6'196'824 bytes
MD5:	82f3539d8578b18fbc931f4f33fcbba3
SHA1:	196f127502d898e7d14cf9521b2b5838a2c1aa14
SHA256:	3393068eec5540b5a987e0c31c601b6d77ec326fcda7d6ddaf62d0d4f9f6db65
SHA512:	1a3a35b7c4090028e99843c442e15bf12a7b38f0840fce144a1686510e95d1f48a102056ee7e7abc263198338432000cdf4a870c8ae7d2284ae65990eaa86c78
SSDEEP:	98304:qq8hnonj3rw5tcmV9w7bO8EBTYOxsBvQem5OSUs3Bl7m/l992S:X8hA/wfcSGEBhs+ZUs3BJm92
TLSH:	1F5622FD62443398C016C9345523FE4AB3B6161E9BEDA8AEF5CB3BC07F5A5109906F42
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."..................x........@..............................p.......j]...`... ............................

File Icon


Icon Hash:	1208ae60a9c35732

Static PE Info

General

Entrypoint:	0xd178db
Entrypoint Section:	.vmp2
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d910780e43eb6473c6ca334d8a16a8af

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/07/2019 02:00:00 20/08/2021 14:00:00
Subject Chain	CN=Malwarebytes Inc, O=Malwarebytes Inc, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	D51B8AEBED6D1E6C35F2F6FB092C0224
Thumbprint SHA-1:	816BE9397F66D1A26EFA04035BCA3BB9E3779740
Thumbprint SHA-256:	642577228C33F97B53278CE40767DE78C84A663F269DB23FFB5538A31CD0FED5
Serial:	08A2EC4E78A09E174B192E5535984B59

Entrypoint Preview

Instruction
push DA2F7259h
call 00007FA0F0E6D1F3h
je 00007FA0F0D451CCh
jmp 00007FA0F0D4521Dh
or byte ptr [eax-4BC33671h], al
retf
xor byte ptr [ecx-35767932h], ah
push ss
xchg eax, edi
aad 3Fh
mov ebx, 3FC0313Ch
stosb
dec esi
xchg eax, esi
and al, C0h
sub al, 9Fh
fcom st(0), st(6)
aas
jc 00007FA0F0D45208h
mov ah, al
aas
pop ebx
imul esi, dword ptr [CE8D3FC3h], D9h
pop ss
shr byte ptr [edi-21h], FFFFFFF9h
or eax, eax
jne 00007FA0F0D451E4h
sbb bh, cl
aas
int3
pop esp
xchg eax, ebp
idiv dword ptr [edi]
mov ebp, C0329705h
jnl 00007FA0F0D4518Fh
push ss
fdivr qword ptr [edi]
sub edi, dword ptr [eax+esi*4+16E13FC9h]
pop ss
sub eax, 595707C0h
fistp qword ptr [edi]
jc 00007FA0F0D45178h
or ebp, ecx
aas
adc esi, ebx
mov ah, CAh
aas
and eax, C01E5846h
xchg eax, esp
jnle 00007FA0F0D45141h
push 836FC3C0h
xchg eax, ebx
mov ecx, dword ptr [esi]
movsb
xor esp, dword ptr [ebx]
sbb al, DEh
add al, ch
rcr dword ptr [edx+eax*2], cl
mov edx, D5662DF8h
mov eax, dword ptr [0FBDD07Eh]
movsb
adc ebx, eax
int 30h
sub al, E2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84ac08	0x8c	.vmp2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaf6000	0xd8c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xaf1db0	0x2d60	.vmp2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5c7200	0x21c58	.vmp2
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaf5000	0x88	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x94a000	0xc0	.vmp2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbe38a	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc0000	0xbb078	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17c000	0x621f0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1df000	0x476	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp0	0x1e0000	0x790a	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.symtab	0x1e8000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ
.vmp1	0x1e9000	0x345541	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp2	0x52f000	0x5c5b10	0x5c5c00	319efad702b2ec814e3c4953ed245933	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xaf5000	0x88	0x200	c6801b3e1c149ccbb62fdb9f350edbad	False	0.232421875	data	1.3604214641515557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xaf6000	0xd8c	0xe00	6f6b92679bd5145f868210239b1d88cf	False	0.5226004464285714	data	4.384633446911444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xaf60e8	0x838	Device independent bitmap graphic, 50 x 100 x 4, image size 1800			0.5570342205323194
RT_GROUP_ICON	0xaf6920	0x14	data			1.1
RT_VERSION	0xaf6938	0x454	data	Catalan	Spain	0.5306859205776173

Imports

DLL	Import
kernel32.dll	WriteFile
WTSAPI32.dll	WTSSendMessageW
kernel32.dll	GetSystemTimeAsFileTime
USER32.dll	GetUserObjectInformationW
kernel32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Catalan	Spain

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tlw8Vv1OPD

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
tlw8Vv1OPD