Automated Malware Analysis Report for Set-up

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000003.1365891931.0000000002963000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://65.21.118.116/7b10d5d78fdd0/9kr80ukf.lvlsi"}

Multi AV Scanner detection for submitted file

Source: Set-up_patched.exe	Virustotal: Detection: 16%			Perma Link
Source: Set-up_patched.exe	ReversingLabs: Detection: 19%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: Set-up_patched.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: Set-up_patched.exe, 00000001.00000003.1356571813.0000000003561000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356369983.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369260619.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369455994.00000000058B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1370249047.00000000059B0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Set-up_patched.exe, 00000001.00000003.1355055709.0000000003620000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1354761565.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361155123.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361489766.0000000005980000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1355952851.00000000035D0000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1355560244.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1367144675.0000000005930000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1363133533.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1355055709.0000000003620000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1354761565.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361155123.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361489766.0000000005980000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up_patched.exe, 00000001.00000003.1355952851.00000000035D0000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1355560244.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1367144675.0000000005930000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1363133533.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1370249047.00000000059B0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1356571813.0000000003561000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356369983.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369260619.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369455994.00000000058B0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_02959608 FindFirstFileExW,

1_3_02959608

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49724
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49721
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49729
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49727
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49726
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49722
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49723
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 65.21.118.116:443 -> 192.168.2.4:49725

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 65.21.118.116 443

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://65.21.118.116/7b10d5d78fdd0/9kr80ukf.lvlsi

Source: Joe Sandbox View

ASN Name: CP-ASDE CP-ASDE

Source: Joe Sandbox View

JA3 fingerprint: f77452325b6e199403fdde60496f54af

Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.118.116

Source: Set-up_patched.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Set-up_patched.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Set-up_patched.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Set-up_patched.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Set-up_patched.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Set-up_patched.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Set-up_patched.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Set-up_patched.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Set-up_patched.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Set-up_patched.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Set-up_patched.exe	String found in binary or memory: http://s2.symcb.com0
Source: Set-up_patched.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Set-up_patched.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Set-up_patched.exe	String found in binary or memory: http://sv.symcd.com0&
Source: Set-up_patched.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: Set-up_patched.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: svchost.exe, 00000007.00000002.1842209191.0000000002FEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://65.21.118.116/7b10d5d78fdd0/9kr80ukf.lvlsi
Source: svchost.exe, 00000007.00000002.1842209191.0000000002FEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://65.21.118.116/7b10d5d78fdd0/9kr80ukf.lvlsix
Source: svchost.exe, 00000007.00000003.1387867625.00000000037A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-query
Source: svchost.exe, 00000007.00000003.1387867625.00000000037A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
Source: Set-up_patched.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Set-up_patched.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: Set-up_patched.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.21.118.116:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_ff9424af-8

Source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_a4b0616b-d

Source: Yara match	File source: 7.3.svchost.exe.59b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Set-up_patched.exe.3650000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Set-up_patched.exe.3430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Set-up_patched.exe.3650000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Set-up_patched.exe.3430000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.59b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.Set-up_patched.exe.3430000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.5790000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1370249047.00000000059B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-up_patched.exe PID: 1600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7596, type: MEMORYSTR

Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F20FD NtAllocateVirtualMemory,	1_3_023F20FD
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F2150 NtFreeVirtualMemory,	1_3_023F2150
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F218E NtProtectVirtualMemory,	1_3_023F218E
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E0B72 NtGetContextThread,NtSetContextThread,NtResumeThread,	1_2_027E0B72
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E066E NtProtectVirtualMemory,	1_2_027E066E
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E10E8 NtTerminateThread,NtClose,	1_2_027E10E8
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E11E5 CreateThread,malloc,NtClose,free,	1_2_027E11E5
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E0CD8 NtAllocateVirtualMemory,NtFreeVirtualMemory,	1_2_027E0CD8
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E19C5 free,NtClose,free,	1_2_027E19C5
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E114C NtClose,	1_2_027E114C
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_2_027E1084 NtClose,	1_2_027E1084

Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F06F3	1_3_023F06F3
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F0000	1_3_023F0000
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0295264D	1_3_0295264D
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0294C3DC	1_3_0294C3DC
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0294C09A	1_3_0294C09A
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0295CC25	1_3_0295CC25
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0294F13B	1_3_0294F13B
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02951170	1_3_02951170

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: String function: 02947FB0 appears 38 times

Source: Set-up_patched.exe, 00000001.00000003.1355055709.00000000037A6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1356369983.00000000034C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1366183802.0000000002969000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exer) vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1355952851.00000000036FD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000002.1369915289.0000000000AE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1356369983.0000000003430000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1366431623.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exer) vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1355560244.0000000003553000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1354761565.00000000035A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003831000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs Set-up_patched.exe
Source: Set-up_patched.exe	Binary or memory string: OriginalFileName vs Set-up_patched.exe

Source: Set-up_patched.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/0@0/1

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_023F0E03 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,

1_3_023F0E03

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-822f03a5-e84a-8af030-5cca4a65ff20}

Source: C:\Users\user\Desktop\Set-up_patched.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Set-up_patched.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Set-up_patched.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-up_patched.exe	Virustotal: Detection: 16%
Source: Set-up_patched.exe	ReversingLabs: Detection: 19%

Source: Set-up_patched.exe

String found in binary or memory: /LOADINF="filename"

Source: unknown	Process created: C:\Users\user\Desktop\Set-up_patched.exe "C:\Users\user\Desktop\Set-up_patched.exe"
Source: C:\Users\user\Desktop\Set-up_patched.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\Desktop\Set-up_patched.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up_patched.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up_patched.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up_patched.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Set-up_patched.exe

Static file information: File size 11537920 > 1048576

Source:	Binary string: wkernel32.pdb source: Set-up_patched.exe, 00000001.00000003.1356571813.0000000003561000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356369983.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369260619.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369455994.00000000058B0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1370249047.00000000059B0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Set-up_patched.exe, 00000001.00000003.1355055709.0000000003620000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1354761565.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361155123.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361489766.0000000005980000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1355952851.00000000035D0000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1355560244.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1367144675.0000000005930000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1363133533.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1355055709.0000000003620000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1354761565.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361155123.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1361489766.0000000005980000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Set-up_patched.exe, 00000001.00000003.1355952851.00000000035D0000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1355560244.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1367144675.0000000005930000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1363133533.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1357703465.0000000003650000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356849239.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1370249047.00000000059B0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Set-up_patched.exe, 00000001.00000003.1356571813.0000000003561000.00000004.00000001.00020000.00000000.sdmp, Set-up_patched.exe, 00000001.00000003.1356369983.0000000003430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369260619.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1369455994.00000000058B0000.00000004.00000001.00020000.00000000.sdmp

Source: Set-up_patched.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB28EC push edi; ret	1_3_02AB28F8
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB10F9 push FFFFFF82h; iretd	1_3_02AB10FB
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB44F9 push edx; retf	1_3_02AB44FC
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB2C39 push ecx; ret	1_3_02AB2C59
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB525D push es; ret	1_3_02AB5264
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB3F89 push edi; iretd	1_3_02AB3F96
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB21DC push eax; ret	1_3_02AB21DD
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB3FD4 push ss; retf	1_3_02AB3FF5
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB0F6A push eax; ret	1_3_02AB0F75
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB4D5E push esi; ret	1_3_02AB4D69
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_029619B4 push ecx; ret	1_3_029619C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_0322296C push edi; ret	7_3_03222978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03221179 push FFFFFF82h; iretd	7_3_0322117B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03224579 push edx; retf	7_3_0322457C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03220FEA push eax; ret	7_3_03220FF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03224DDE push esi; ret	7_3_03224DE9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03224009 push edi; iretd	7_3_03224016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03224054 push ss; retf	7_3_03224075
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_0322225C push eax; ret	7_3_0322225D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03222CB9 push ecx; ret	7_3_03222CD9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_032252DD push es; ret	7_3_032252E4

Source: C:\Users\user\Desktop\Set-up_patched.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Set-up_patched.exe	API/Special instruction interceptor: Address: 7FFCC372D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFCC372D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 5A5B83A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EVERYWHERE.EXEFIDDLER.EXEIDA.EXEIDA64.EXEIMMUX
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHA
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TORUNS.EXEDUMPCAP.EXEDE4
Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_02959608 FindFirstFileExW,

1_3_02959608

Source: svchost.exe, 00000007.00000002.1844012625.0000000003880000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: fcqEmU
Source: svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: svchost.exe, 00000007.00000002.1843140471.0000000003647000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.1843430368.000000000365C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRSVP UDPv6 Service Provider
Source: svchost.exe, 00000007.00000002.1843140471.0000000003612000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: svchost.exe, 00000007.00000003.1369888380.0000000005790000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity

Source: C:\Users\user\Desktop\Set-up_patched.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_023F201F LdrLoadDll,

1_3_023F201F

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_02954B0C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_3_02954B0C

Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02AB0277 mov eax, dword ptr fs:[00000030h]	1_3_02AB0277
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F0CB3 mov eax, dword ptr fs:[00000030h]	1_3_023F0CB3
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F06F3 mov edx, dword ptr fs:[00000030h]	1_3_023F06F3
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F1063 mov eax, dword ptr fs:[00000030h]	1_3_023F1063
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F1CF1 mov eax, dword ptr fs:[00000030h]	1_3_023F1CF1
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F1303 mov eax, dword ptr fs:[00000030h]	1_3_023F1303
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_023F1302 mov eax, dword ptr fs:[00000030h]	1_3_023F1302
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_03220283 mov eax, dword ptr fs:[00000030h]	7_3_03220283

Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02954B0C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_3_02954B0C
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_0294800F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_3_0294800F
Source: C:\Users\user\Desktop\Set-up_patched.exe	Code function: 1_3_02947D4D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_3_02947D4D

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 65.21.118.116 443

Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_0294781B cpuid

1_3_0294781B

Source: C:\Windows\SysWOW64\svchost.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up_patched.exe

Code function: 1_3_02947C40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_3_02947C40

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe, 00000007.00000002.1843553014.0000000003700000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OllyDbg.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000001.00000003.1353660325.00000000009E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1360064935.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1844012625.0000000003880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1360699468.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000001.00000003.1353660325.00000000009E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1360064935.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1844012625.0000000003880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1360699468.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Automated Malware Analysis Report for Set-up_patched.exe (2025)

AV Detection

Networking

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality