About C source
Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1036\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1038\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1045\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1029\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1028\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1037\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1025\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1032\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1042\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1041\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1044\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1053\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\3082\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1046\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\2070\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1055\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\2052\eula.rtf Jump to behavior Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe File created: C:\763137b86821bd1c08f9f02853123b\1049\eula.rtf Jump to behavior Source: ShareX-14.1.0-setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE Source: Binary string: C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: dotnetfx48.exe, dotnetfx48.exe, 00000002.00000002.579371547.0000000000B81000.00000020.00000001.01000000.00000007.sdmp Source: Binary string: sqmapi.pdb source: dotnetfx48.exe, 00000002.00000003.460230508.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, dotnetfx48.exe, 00000002.00000003.460268843.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp, dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: SetupEngine.pdb source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: SetupUtility.pdb source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: SetupUtility.pdb5 source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: Setup.pdb source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: -C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: dotnetfx48.exe, 00000002.00000002.579371547.0000000000B81000.00000020.00000001.01000000.00000007.sdmp Source: Binary string: SetupResources.pdb source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: Binary string: SetupUi.pdb source: dotnetfx48.exe, 00000002.00000003.455484280.0000000005F25000.00000004.00000800.00020000.00000000.sdmp Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe Code function: 2_2_00B8AC78 FindFirstFileW,GetLastError,FindNextFileW,CloseHandle,FindClose, 2_2_00B8AC78 Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe Code function: 2_2_00B89923 GetFileAttributesW,GetLastError,SetFileAttributesW,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,FindClose,RemoveDirectoryW,GetLastError, 2_2_00B89923 Source: C:\Users\user\AppData\Local\Temp\is-9287N.tmp\dotnetfx48.exe Code function: 2_2_00B87D39 GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,GetLogicalDriveStringsW,CharUpperW,_wcschr,GetDiskFreeSpaceExW, 2_2_00B87D39 Source: ShareX-14.1.0-setup.tmp, 00000001.00000002.581069165.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, ShareX-14.1.0-setup.tmp, 00000001.00000003.382998607.0000000000961000.00000004.00000020.00020000.00000000.sdmp String found in binary
Key features of the C source that are enabled through these drivers include:
- The Premier Source for C-level Executives!: C-Source Group
- C/C Symbols - Source Insight
- C/C Source Code Formatter
- C Source Wizard Software - Free Download C Source - WinSite
- Implementation of an Obfuscation Tool for C/C Source
- The Project is a C/C Source Code Obfuscator and
- Free C/C Source Code - Cprogramming.com
Name: Source: lumion.pro.v11-cgp-tpc.exe Static PE information: section name: .adata Source: initial sample Static PE information: section name: entropy: 7.98697872083 Source: initial sample Static PE information: section name: entropy: 7.94409388118 Source: initial sample Static PE information: section name: entropy: 7.79720566066 Source: initial sample Static PE information: section name: .data entropy: 7.74718140928 Persistence and Installation Behavior: Source: C:\Users\alfredo\Desktop\lumion.pro.v11-cgp-tpc.exe File created: C:\Users\alfredo\AppData\Local\Temp\Acknowledge -BRK-.FON Jump to dropped file Source: C:\Users\alfredo\Desktop\lumion.pro.v11-cgp-tpc.exe File created: C:\Users\alfredo\AppData\Local\Temp\bassmod.dll Jump to dropped file Drops files with a non-matching file extension (content does not match file extension) Source: C:\Users\alfredo\Desktop\lumion.pro.v11-cgp-tpc.exe File created: C:\Users\alfredo\AppData\Local\Temp\Acknowledge -BRK-.FON Jump to dropped file Malware Analysis System Evasion: Found dropped PE file which has not been started or loaded Source: C:\Users\alfredo\Desktop\lumion.pro.v11-cgp-tpc.exe Dropped PE file which has not been started: C:\Users\alfredo\AppData\Local\Temp\Acknowledge -BRK-.FON Jump to dropped file May sleep (evasive loops) to hinder dynamic analysis Source: C:\Windows\System32\svchost.exe TID: 5760 Thread sleep time: -30000s >= -30000s Queries disk information (often used to detect virtual machines) Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 HIPS / PFW / Operating System Protection Evasion: System process connects to network (likely due to code injection or exploit) Source: C:\Windows\System32\svchost.exe Domain query: g.live.com Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
