Edit tour

Windows Analysis Report
nc.exe

Overview

General Information

Sample Name:	nc.exe
Analysis ID:	1307249
MD5:	c90459986070e38fd8260d4430e23dfd
SHA1:	ce3e01c3fce1f4563335cda87df7406c8ad2b6b7
SHA256:	109c04127c3168a386744027413d11a84c6b5c91738b05f5c5e40c45e07b72f9
Tags:	ChineseAPTexeHUN
Infos:

Detection

Netcat

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Netcat

Creates a DirectInput object (often for capturing keystrokes)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Program does not show much activity (idle)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Classification

Process Tree

System is w10x64

nc.exe (PID: 6828 cmdline: C:\Users\user\Desktop\nc.exe MD5: C90459986070E38FD8260D4430E23DFD)

conhost.exe (PID: 6836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
nc.exe	JoeSecurity_Netcat	Yara detected Netcat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Netcat	Yara detected Netcat	Joe Security
00000000.00000000.377888447.0000000000408000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Netcat	Yara detected Netcat	Joe Security
Process Memory Space: nc.exe PID: 6828	JoeSecurity_Netcat	Yara detected Netcat	Joe Security

Code function: 0_2_0040446D time,_isatty,_setmode,_isatty,_setmode,_close,_sleep,_errno,WSASetLastError,__WSAFDIsSet,memcpy,memcpy,select,WSAGetLastError,WSAGetLastError,shutdown,closesocket,time,shutdown,closesocket,WSASetLastError,__WSAFDIsSet,time,recv,_kbhit,gets,strcat,strlen,_close,_read,_close,_close,_write,_iob,fflush,send,_sleep,_errno,shutdown,closesocket,

0_2_0040446D

Source: nc.exe, 00000000.00000002.650060409.0000000000638000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_cafd4fb1-8

Source: nc.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: nc.exe

ReversingLabs: Detection: 28%

Source: nc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal60.spre.winEXE@2/1@0/0

Source: unknown	Process created: C:\Users\user\Desktop\nc.exe C:\Users\user\Desktop\nc.exe
Source: C:\Users\user\Desktop\nc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_01

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\nc.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-2359

Source: C:\Users\user\Desktop\nc.exe

API coverage: 3.5 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: nc.exe, 00000000.00000002.650060409.0000000000638000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\nc.exe

Code function: 0_2_00401150 SetUnhandledExceptionFilter,__getmainargs,_iob,_iob,_setmode,_iob,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,_iob,_setmode,_iob,

0_2_00401150

Source: C:\Users\user\Desktop\nc.exe

Code function: 0_2_00405B80 cpuid

0_2_00405B80

Source: C:\Users\user\Desktop\nc.exe	Code function: 0_2_00403829 _errno,WSASetLastError,socket,socket,_dup,setsockopt,memcpy,htons,bind,_errno,inet_ntoa,_sleep,_errno,inet_ntoa,memcpy,htons,_setjmp,connect,WSASetLastError,WSAGetLastError,_errno,shutdown,closesocket,_errno,WSASetLastError,		0_2_00403829
Source: C:\Users\user\Desktop\nc.exe	Code function: 0_2_00403BA8 _errno,listen,getsockname,strcpy,inet_ntoa,strcat,strcat,strcat,htons,_setjmp,recvfrom,connect,_setjmp,accept,shutdown,closesocket,memset,getsockname,inet_ntoa,strcpy,htons,inet_ntoa,strcpy,_errno,memcmp,_errno,shutdown,closesocket,		0_2_00403BA8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nc.exe	29%	ReversingLabs	Win32.Trojan.Generic
nc.exe	100%	Avira	BDS/Backdoor.Gen

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1307249
Start date and time:	2023-09-11 13:11:48 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	nc.exe
Detection:	MAL
Classification:	mal60.spre.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, tse1.mm.bing.net, g.bing.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: nc.exe

Process:	C:\Users\user\Desktop\nc.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:umFn:D
MD5:	552430716D5ECD7EB607728C6AA6D750
SHA1:	343C92A87B4E6887E140DFA476AEBAD03C4ABFD5
SHA-256:	E58FE825DF1CD85145B06292195AA553F11577105BA848731FAF0C774EE56648
SHA-512:	8DC6C13551BFDB196595B1368A5B72A5D85FE22736466C6DD5127A4F62C7D1E73A004C8F86072EAC245BF905A5336F5E8DE913D6B5F5010F98AE03F1DE503C01
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Cmd line:

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.156999044074612
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	nc.exe
File size:	58'888 bytes
MD5:	c90459986070e38fd8260d4430e23dfd
SHA1:	ce3e01c3fce1f4563335cda87df7406c8ad2b6b7
SHA256:	109c04127c3168a386744027413d11a84c6b5c91738b05f5c5e40c45e07b72f9
SHA512:	6da06ebcf86251d4617f74ac63b07d3c161937961874434774e85edb6f7da2f0166080860066832da790d9a87948bc460f714980819f42aa3f8f6b543fd50f11
SSDEEP:	768:UU9M7HdpLfr1wD+lFn7uqXXlfHbE2mmuL6JZs0L7Yp8O6bpbec2V:UN7m4jlf7XmRsZv/9X2V
TLSH:	C34332E5BACA9DE7EA1452BCCCAAD676203CF4E087134F5396744C325B62E927CD4213
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y.L.x..#..........8.T...t...............p....@..................................!........ ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401280
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x4CC77990 [Wed Oct 27 01:00:00 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9284347e8448a2e126e2a8d612a42f54

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 08h
mov dword ptr [esp], 00000001h
call dword ptr [0040B2A8h]
call 00007F37CCEA5C0Dh
nop
lea esi, dword ptr [esi+00000000h]
push ebp
mov ebp, esp
sub esp, 08h
mov dword ptr [esp], 00000002h
call dword ptr [0040B2A8h]
call 00007F37CCEA5BEDh
nop
lea esi, dword ptr [esi+00000000h]
push ebp
mov ecx, dword ptr [0040B2D4h]
mov ebp, esp
pop ebp
jmp ecx
lea esi, dword ptr [esi+00h]
push ebp
mov ecx, dword ptr [0040B2C0h]
mov ebp, esp
pop ebp
jmp ecx
nop
nop
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp 00007F37CCEAA7ACh
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 04h
mov eax, dword ptr [ebp+08h]
cmp byte ptr [eax], 00000000h
je 00007F37CCEA5D6Ah
mov eax, dword ptr [ebp+08h]
movsx eax, byte ptr [eax]
cmp eax, dword ptr [ebp+0Ch]
jne 00007F37CCEA5D5Ah
mov eax, dword ptr [ebp+08h]
mov dword ptr [ebp-04h], eax
jmp 00007F37CCEA5D5Eh
inc dword ptr [ebp+08h]
jmp 00007F37CCEA5D32h
mov dword ptr [ebp-04h], 00000000h
mov eax, dword ptr [ebp-04h]
leave
ret
push ebp
mov ebp, esp
push ebx
sub esp, 1Ch
mov eax, dword ptr [0040A048h]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [0040A058h]
mov dword ptr [ebp-0Ch], eax
mov eax, dword ptr [0040A014h]
mov dword ptr [ebp-10h], eax
mov eax, dword ptr [ebp-10h]
cmp eax, dword ptr [ebp-0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb000	0xa70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5304	0x5400	False	0.44228980654761907	data	5.598404569723046	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7000	0xb0	0x200	False	0.189453125	Matlab v4 mat-file (little endian) (UNKNOWN), text, rows 63, columns 0	1.2831406116232933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x8000	0x1010	0x1200	False	0.4249131944444444	data	4.971079818250585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xa000	0x280	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb000	0xa70	0xc00	False	0.3505859375	data	4.073144532935977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	AddAtomA, CloseHandle, CreatePipe, CreateProcessA, CreateThread, DisconnectNamedPipe, DuplicateHandle, ExitProcess, ExitThread, FindAtomA, FreeConsole, GetAtomNameA, GetCurrentProcess, GetLastError, GetStdHandle, PeekNamedPipe, ReadFile, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TerminateThread, WaitForMultipleObjects, WriteFile
msvcrt.dll	_close, _dup, _itoa, _kbhit, _open, _read, _strcmpi, _strnicmp, _write
msvcrt.dll	__getmainargs, __p__environ, __p__fmode, __set_app_type, _assert, _cexit, _errno, _iob, _isatty, _onexit, _setjmp, _setmode, _sleep, abort, atexit, atoi, exit, fflush, fprintf, free, getenv, gets, longjmp, malloc, memcmp, memcpy, memset, rand, signal, sprintf, srand, strcat, strchr, strcmp, strcpy, strlen, strncmp, strncpy, time
WSOCK32.DLL	WSACleanup, WSAGetLastError, WSASetLastError, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, getservbyname, getservbyport, getsockname, htons, inet_addr, inet_ntoa, listen, ntohs, recv, recvfrom, select, send, setsockopt, shutdown, socket

• nc.exe
• conhost.exe

Click to jump to process

Memory Usage

• nc.exe
• conhost.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	13:12:47
Start date:	11/09/2023
Path:	C:\Users\user\Desktop\nc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\nc.exe
Imagebase:	0x400000
File size:	58'888 bytes
MD5 hash:	C90459986070E38FD8260D4430E23DFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Netcat, Description: Yara detected Netcat, Source: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Netcat, Description: Yara detected Netcat, Source: 00000000.00000000.377888447.0000000000408000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:12:47
Start date:	11/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	644
Total number of Limit Nodes:	1

Callgraph

Hide Legend

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,00401298), ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 5ccf9f71e1772bdbbf39e5b335e3ec5758c075b78937d724ca577ce6272db996
Instruction ID: b2a29bb59dfddbed60e9d4291c6854c0dc59f2d1d3290c6ab55ec4b5ee31e2ac
Opcode Fuzzy Hash: 5ccf9f71e1772bdbbf39e5b335e3ec5758c075b78937d724ca577ce6272db996
Instruction Fuzzy Hash: 8C31E6749047048FC740EF79D585A1A77F4FB48354F018A7EE485A73A1DB38A850DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404B3F Relevance: 47.8, APIs: 25, Strings: 2, Instructions: 535
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004028D0: WSAStartup.WSOCK32 ref: 004028F0

Part of subcall function 00403097: malloc.MSVCRT ref: 004030AF
Part of subcall function 00403097: memset.MSVCRT ref: 004030D2

malloc.MSVCRT ref: 00404C34
_errno.MSVCRT ref: 00404C46
fprintf.MSVCRT ref: 00404CB1
fflush.MSVCRT ref: 00404CC1
_read.MSVCRT ref: 00404CDC
memcpy.MSVCRT ref: 00404D45
strchr.MSVCRT ref: 00404D5D
strchr.MSVCRT ref: 00404D84

Part of subcall function 00402F82: shutdown.WSOCK32 ref: 00402FD6
Part of subcall function 00402F82: closesocket.WSOCK32 ref: 00402FE6
Part of subcall function 00402F82: _sleep.MSVCRT ref: 00402FF5
Part of subcall function 00402F82: exit.MSVCRT ref: 00403001
Part of subcall function 00402F82: _errno.MSVCRT ref: 0040300C

Strings

-, xrefs: 004053EF
3, xrefs: 00404E21

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _errnomallocstrchr$Startup_read_sleepclosesocketexitfflushfprintfmemcpymemsetshutdown
String ID: -$3
API String ID: 252166648-2179763217
Opcode ID: d6f3d651980bc7f2da0cd37318467a5da7418944ce8d8500b5e6a3aae846b490
Instruction ID: 1ef7e52fd0711f9fae56f10bd1047bcc78a6a35cab79e0fb5138a11a05c26703
Opcode Fuzzy Hash: d6f3d651980bc7f2da0cd37318467a5da7418944ce8d8500b5e6a3aae846b490
Instruction Fuzzy Hash: D542C4B4904609DFDB10EF69D6447AEBBF0FB44308F00882EE485AB391D3799994DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004028D0 Relevance: 3.0, APIs: 2, Instructions: 25
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WSOCK32 ref: 004028F0

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d4d4897f77f9a831faf0b04030197b9fc0de5fe4051e218cc7902d3bfd0c03eb
Instruction ID: 12d7a9241bd70b487e9e8ceb51e60967d66dd23e63bf4637674b5b0b6a08df7f
Opcode Fuzzy Hash: d4d4897f77f9a831faf0b04030197b9fc0de5fe4051e218cc7902d3bfd0c03eb
Instruction Fuzzy Hash: 74F01274F0522C9DDB20AB6595493EDB7F4AF02305F4005ABD4C5722C0E6BC8989CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040128D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,00401298), ref: 0040115E
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119E
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D8
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FC
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401210
Part of subcall function 00401150: __p__environ.MSVCRT ref: 0040122A
Part of subcall function 00401150: _cexit.MSVCRT ref: 0040124D
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401255
Part of subcall function 00401150: _setmode.MSVCRT ref: 0040126F

__set_app_type.MSVCRT ref: 004012AD

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 2043081007-0
Opcode ID: ccdb75c038e21b3412f0778672d55d0ec663c20d7a429cc5ba2fb924a44e5c23
Instruction ID: 0fc9b1ea2834b4d55f9e3481def7c8755dcfaf78b5b63eca07436e3d5fb50777
Opcode Fuzzy Hash: ccdb75c038e21b3412f0778672d55d0ec663c20d7a429cc5ba2fb924a44e5c23
Instruction Fuzzy Hash: 28D06235405214ABC3003BB5DD0A35DBBA8AB05301F41053CE6C577271D778384547DA

Uniqueness

Uniqueness Score: -1.00%

Function 00403097 Relevance: 2.5, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004030AF
memset.MSVCRT ref: 004030D2

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: mallocmemset
String ID:
API String ID: 2882185209-0
Opcode ID: 776f2886ea24ebb40fe1cd321e2564f421eda7a237da9ace3bb0caa819d1d9a2
Instruction ID: 610e233dd54368f0e48f107edaa981eaecc20945b78952e42fd8a403bd4c74ca
Opcode Fuzzy Hash: 776f2886ea24ebb40fe1cd321e2564f421eda7a237da9ace3bb0caa819d1d9a2
Instruction Fuzzy Hash: E9F0A470905208EBCB00EFA9C58565DBBF4AF04308F1184AEE885A7381D778AA80DB46

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040446D Relevance: 58.9, APIs: 39, Instructions: 427
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

time.MSVCRT ref: 00404488
_isatty.MSVCRT ref: 00404494
_setmode.MSVCRT ref: 004044AC
_isatty.MSVCRT ref: 004044B8
_setmode.MSVCRT ref: 004044D5
_close.MSVCRT ref: 004045EF
_sleep.MSVCRT ref: 00404605
_errno.MSVCRT ref: 0040460A
WSASetLastError.WSOCK32 ref: 0040461C
__WSAFDIsSet.WSOCK32 ref: 00404633
memcpy.MSVCRT ref: 00404678
memcpy.MSVCRT ref: 0040469F
select.WSOCK32 ref: 004046CB
WSAGetLastError.WSOCK32 ref: 004046DC
WSAGetLastError.WSOCK32 ref: 004046E8
shutdown.WSOCK32 ref: 0040470A
closesocket.WSOCK32 ref: 00404718
time.MSVCRT ref: 0040473C
shutdown.WSOCK32 ref: 00404781
closesocket.WSOCK32 ref: 0040478F
WSASetLastError.WSOCK32 ref: 004047A9
__WSAFDIsSet.WSOCK32 ref: 004047CC
time.MSVCRT ref: 004047E2
recv.WSOCK32 ref: 00404806
_kbhit.MSVCRT ref: 004048BD
gets.MSVCRT ref: 004048D2
strcat.MSVCRT ref: 004048E7
strlen.MSVCRT ref: 004048F4
_close.MSVCRT ref: 00404924
_read.MSVCRT ref: 00404943
_close.MSVCRT ref: 00404958
_close.MSVCRT ref: 00404987
_write.MSVCRT ref: 00404A02
fflush.MSVCRT ref: 00404A12
send.WSOCK32 ref: 00404AA0
_sleep.MSVCRT ref: 00404AD9
_errno.MSVCRT ref: 00404ADE
shutdown.WSOCK32 ref: 00404B1A
closesocket.WSOCK32 ref: 00404B28

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLast_close$closesocketshutdowntime$_errno_isatty_setmode_sleepmemcpy$_kbhit_read_writefflushgetsrecvselectsendstrcatstrlen
String ID:
API String ID: 3999812599-0
Opcode ID: 39fa05aa31d10d10c0bc0456772fc601b339261855aa14d69fcded914fb68f28
Instruction ID: 2c93763f636bf7982f465ebb7d121f96439a7f7c435dab8046fe155020e47178
Opcode Fuzzy Hash: 39fa05aa31d10d10c0bc0456772fc601b339261855aa14d69fcded914fb68f28
Instruction Fuzzy Hash: E922D5B4904308DFDB10EFA9D58475EBBF0FB48304F10842AE985AB391D7789995CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403BA8 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 278
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 00403BC3

Part of subcall function 00403829: _errno.MSVCRT ref: 0040383E
Part of subcall function 00403829: WSASetLastError.WSOCK32 ref: 00403850
Part of subcall function 00403829: socket.WSOCK32 ref: 00403879
Part of subcall function 00403829: _dup.MSVCRT ref: 004038D2
Part of subcall function 00403829: setsockopt.WSOCK32 ref: 00403905
Part of subcall function 00403829: memcpy.MSVCRT ref: 00403956
Part of subcall function 00403829: htons.WSOCK32 ref: 0040396F
Part of subcall function 00403829: inet_ntoa.WSOCK32 ref: 00403A46

getsockname.WSOCK32 ref: 00403C7A
strcpy.MSVCRT ref: 00403CA7
inet_ntoa.WSOCK32 ref: 00403CC2
strcat.MSVCRT ref: 00403CD6
strcat.MSVCRT ref: 00403D02
htons.WSOCK32 ref: 00403D13
_setjmp.MSVCRT ref: 00403D65
recvfrom.WSOCK32 ref: 00403DA1
connect.WSOCK32 ref: 00403DD4
shutdown.WSOCK32 ref: 00404036

Strings

@, xrefs: 00403E7E

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _errnohtonsinet_ntoastrcat$ErrorLast_dup_setjmpconnectgetsocknamememcpyrecvfromsetsockoptshutdownsocketstrcpy
String ID: @
API String ID: 3180767748-2766056989
Opcode ID: 04a7635a6cf578ca84297678b22ca44b553d2c80e9f977fe9165d0359ccfb7aa
Instruction ID: 68810559001089906fd8573ee2d96bf6fc2683d2137b0bc9ffbaf30d5933130b
Opcode Fuzzy Hash: 04a7635a6cf578ca84297678b22ca44b553d2c80e9f977fe9165d0359ccfb7aa
Instruction Fuzzy Hash: 3DD190B4904305DFDB00EFA9C54966EBBF0BF48304F01882EE894A7391E7789994DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403829 Relevance: 37.7, APIs: 25, Instructions: 204
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 0040383E
WSASetLastError.WSOCK32 ref: 00403850
socket.WSOCK32 ref: 00403879
socket.WSOCK32 ref: 0040389F
_dup.MSVCRT ref: 004038D2
setsockopt.WSOCK32 ref: 00403905
memcpy.MSVCRT ref: 00403956
htons.WSOCK32 ref: 0040396F
bind.WSOCK32 ref: 004039C5
_errno.MSVCRT ref: 004039D8
inet_ntoa.WSOCK32 ref: 00403A46
memcpy.MSVCRT ref: 00403A99
htons.WSOCK32 ref: 00403AAB
_setjmp.MSVCRT ref: 00403AE8
connect.WSOCK32 ref: 00403B0A
WSASetLastError.WSOCK32 ref: 00403B25
WSAGetLastError.WSOCK32 ref: 00403B51
_errno.MSVCRT ref: 00403B58
shutdown.WSOCK32 ref: 00403B6F
closesocket.WSOCK32 ref: 00403B7F
_errno.MSVCRT ref: 00403B87
WSASetLastError.WSOCK32 ref: 00403B91

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLast_errno$htonsmemcpysocket$_dup_setjmpbindclosesocketconnectinet_ntoasetsockoptshutdown
String ID:
API String ID: 3116141737-0
Opcode ID: cebecbf1948128c84a897a449a8a71be53735ef64cd7bb28cff415594c858c9a
Instruction ID: cb6bf92ac2ae36df461301d33440b0a49c4f5f323d04458afb416de52c00d575
Opcode Fuzzy Hash: cebecbf1948128c84a897a449a8a71be53735ef64cd7bb28cff415594c858c9a
Instruction Fuzzy Hash: 78A1F6B0904305DFDB00FF65D68936ABBF4BB04309F11893EE885AB291D3789994DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00405B80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0464e965de918735676d5588757127b1df1ed642007614594c902c391adfb61
Instruction ID: bf907c1f4d2a70a300ee28d3a5b8865cbc45d60bac5e03ab3dee2a637f9031e1
Opcode Fuzzy Hash: d0464e965de918735676d5588757127b1df1ed642007614594c902c391adfb61
Instruction Fuzzy Hash: 3511AB71108B154AF3298618EA497933A65F354314F14853ED906F93F1D3BDDD90CA0D

Uniqueness

Uniqueness Score: -1.00%

Function 00402077 Relevance: 39.2, APIs: 26, Instructions: 219
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401E00: malloc.MSVCRT ref: 00401E23

CreateThread.KERNEL32 ref: 004020D3
GetLastError.KERNEL32 ref: 004020E7
_itoa.MSVCRT ref: 004020FF

Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F1F
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F24
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F2D
Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F51
Part of subcall function 00402ECF: fflush.MSVCRT ref: 00402F7B

CreateThread.KERNEL32 ref: 00402181
GetLastError.KERNEL32 ref: 00402199
_itoa.MSVCRT ref: 004021B1
TerminateThread.KERNEL32 ref: 00402209

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLast$Thread$Create_itoafprintf$Terminatefflushmalloc
String ID:
API String ID: 3697086593-0
Opcode ID: 10572a788af219330ef33cc0ec57ca242faa5f6ad944d3b1b4897c30640919eb
Instruction ID: 3776174efba38127411f1320ec35b2f68c9a9832294c0841666b97e542e3db12
Opcode Fuzzy Hash: 10572a788af219330ef33cc0ec57ca242faa5f6ad944d3b1b4897c30640919eb
Instruction Fuzzy Hash: C9B17DB5904704DFDB00EFA9C18974EBBF0EF44308F41896EE894AB391D37899588F96

Uniqueness

Uniqueness Score: -1.00%

Function 004031B3 Relevance: 28.7, APIs: 19, Instructions: 218
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 004031C7
strcpy.MSVCRT ref: 00403207
inet_addr.WSOCK32 ref: 00403212
gethostbyname.WSOCK32 ref: 00403247
WSAGetLastError.WSOCK32 ref: 00403258
strncpy.MSVCRT ref: 0040328B
memcpy.MSVCRT ref: 004032E7
inet_ntoa.WSOCK32 ref: 004032FC
strncpy.MSVCRT ref: 00403326

Part of subcall function 00403097: malloc.MSVCRT ref: 004030AF
Part of subcall function 00403097: memset.MSVCRT ref: 004030D2

gethostbyaddr.WSOCK32 ref: 0040338E
WSAGetLastError.WSOCK32 ref: 004033A7
memcpy.MSVCRT ref: 00403409
inet_ntoa.WSOCK32 ref: 00403414
strncpy.MSVCRT ref: 00403433
gethostbyaddr.WSOCK32 ref: 00403475
WSAGetLastError.WSOCK32 ref: 00403486

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLaststrncpy$gethostbyaddrinet_ntoamemcpy$_errnogethostbynameinet_addrmallocmemsetstrcpy
String ID:
API String ID: 2342530455-0
Opcode ID: b9942a84afb539e0eda7b6ed3162e11b2fe907c25a7a57c16b796f68144fe27c
Instruction ID: 1b65a61c478efe84f4354dbc273b01f441d4b55b229c26b46f73aa6b5a72dc0f
Opcode Fuzzy Hash: b9942a84afb539e0eda7b6ed3162e11b2fe907c25a7a57c16b796f68144fe27c
Instruction Fuzzy Hash: 58A1DBB0904209DFDB00EFA8C5856AEBBF0FF44305F10886EE485AB391D7789A84CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401E00 Relevance: 21.1, APIs: 14, Instructions: 142
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00401E23
CreatePipe.KERNEL32 ref: 00401E81
GetLastError.KERNEL32 ref: 00401E92
_itoa.MSVCRT ref: 00401EAA
CloseHandle.KERNEL32 ref: 0040200F
CloseHandle.KERNEL32 ref: 00402023
CloseHandle.KERNEL32 ref: 0040203B
CloseHandle.KERNEL32 ref: 00402055
free.MSVCRT ref: 00402063

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastPipe_itoafreemalloc
String ID:
API String ID: 2877767537-0
Opcode ID: 6c217010293287cfd7200fa62ad3d828bb5f4129676e82021c0155888544c6fc
Instruction ID: d1cc404e7ce06c917d4e96b2f805319fd7073a00040dc44ca341ce4c7169a73c
Opcode Fuzzy Hash: 6c217010293287cfd7200fa62ad3d828bb5f4129676e82021c0155888544c6fc
Instruction Fuzzy Hash: 456198B0805705DFEB00EFA5C18979EBBF0EF44308F10896EE8956B291D7B99548CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004025BB Relevance: 19.7, APIs: 13, Instructions: 175
threadfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekNamedPipe.KERNEL32 ref: 004025FE
ReadFile.KERNEL32 ref: 0040264A
Sleep.KERNEL32 ref: 0040265B
send.WSOCK32 ref: 00402725
GetLastError.KERNEL32 ref: 00402735
GetLastError.KERNEL32 ref: 0040273F
_itoa.MSVCRT ref: 00402757
ExitThread.KERNEL32 ref: 0040279B
recv.WSOCK32 ref: 004027D9
_strnicmp.MSVCRT ref: 00402842
ExitThread.KERNEL32 ref: 00402852
WriteFile.KERNEL32 ref: 004028A3
ExitThread.KERNEL32 ref: 004028C7

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ExitThread$ErrorFileLast$NamedPeekPipeReadSleepWrite_itoa_strnicmprecvsend
String ID:
API String ID: 715083019-0
Opcode ID: c529273add3dfaa1fc56797edcac1404f6c1d3707c77490e89bcca9a942f96ff
Instruction ID: 812cba63fcffcf901759d42b92c3547cfe5b8ab2797f02535df047f268386e0e
Opcode Fuzzy Hash: c529273add3dfaa1fc56797edcac1404f6c1d3707c77490e89bcca9a942f96ff
Instruction Fuzzy Hash: F5914E74904319DFDB10EF68C58879EBBF4EF45344F4089AAD488A7381D7B89A88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040351D Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WSOCK32 ref: 00403585
getservbyport.WSOCK32 ref: 0040359F
htons.WSOCK32 ref: 004035BE
strncpy.MSVCRT ref: 00403609
sprintf.MSVCRT ref: 004036F2

Strings

"p@, xrefs: 00403534
@, xrefs: 00403698

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: htons$getservbyportsprintfstrncpy
String ID: "p@$@
API String ID: 3015932977-3786540563
Opcode ID: 7b4d9b4591384e893e6d9c61fc36fe7f64902d931136992fe0f6443062b520dc
Instruction ID: 744cfc42fd78bbf95e49668f0f7f0cbdb84426594174ba2373b19d373039ff26
Opcode Fuzzy Hash: 7b4d9b4591384e893e6d9c61fc36fe7f64902d931136992fe0f6443062b520dc
Instruction Fuzzy Hash: 5C51E2B4904318EECB10EFA9C54476DBBF4FF04345F50886AE885AB391E37C9A84DB56

Uniqueness

Uniqueness Score: -1.00%

Function 00404058 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WSOCK32 ref: 0040407D
_errno.MSVCRT ref: 0040408E

Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F1F
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F24
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F2D
Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F51
Part of subcall function 00402ECF: fflush.MSVCRT ref: 00402F7B

Part of subcall function 00403829: _errno.MSVCRT ref: 0040383E
Part of subcall function 00403829: WSASetLastError.WSOCK32 ref: 00403850
Part of subcall function 00403829: socket.WSOCK32 ref: 00403879
Part of subcall function 00403829: _dup.MSVCRT ref: 004038D2
Part of subcall function 00403829: setsockopt.WSOCK32 ref: 00403905
Part of subcall function 00403829: memcpy.MSVCRT ref: 00403956
Part of subcall function 00403829: htons.WSOCK32 ref: 0040396F
Part of subcall function 00403829: inet_ntoa.WSOCK32 ref: 00403A46

_sleep.MSVCRT ref: 004040B6
shutdown.WSOCK32 ref: 0040410A
closesocket.WSOCK32 ref: 00404118
_errno.MSVCRT ref: 00404138
send.WSOCK32 ref: 00404162
shutdown.WSOCK32 ref: 00404189
closesocket.WSOCK32 ref: 00404197

Strings

iz, xrefs: 004040E0

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLast_errno$closesocketfprintfsendshutdown$_dup_sleepfflushhtonsinet_ntoamemcpysetsockoptsocket
String ID: iz
API String ID: 912985972-1161189939
Opcode ID: 511a912a00d4491d3990e70137e5ded1860bd43f8c7f80d84e3ba8f24e7322b2
Instruction ID: 34c7a4c70d11b6233b84278bbde6e1ff19722ab5da9ffacb43e31969e5b7ae55
Opcode Fuzzy Hash: 511a912a00d4491d3990e70137e5ded1860bd43f8c7f80d84e3ba8f24e7322b2
Instruction Fuzzy Hash: 5C31E7B0814704DFD700FF65D68935EBBF0EB44358F10886EE884AB391D37996989F4A

Uniqueness

Uniqueness Score: -1.00%

Function 00402439 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004024A8
GetCurrentProcess.KERNEL32 ref: 004024AF
DuplicateHandle.KERNEL32 ref: 004024E6
CreateProcessA.KERNEL32 ref: 0040253C
CloseHandle.KERNEL32 ref: 00402554
GetLastError.KERNEL32 ref: 0040255E
_itoa.MSVCRT ref: 00402576

Strings

D, xrefs: 0040244A

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: Process$CurrentHandle$CloseCreateDuplicateErrorLast_itoa
String ID: D
API String ID: 1554987783-2746444292
Opcode ID: d5aa1974ed85d349a8d2c4cf5adf57c7c616c5c7661a19cbc9a2feabadb2b9b4
Instruction ID: aca483b5e203881d84b43a89d7403c2f3b622e2447578a08dc1a50f0580ba481
Opcode Fuzzy Hash: d5aa1974ed85d349a8d2c4cf5adf57c7c616c5c7661a19cbc9a2feabadb2b9b4
Instruction Fuzzy Hash: 924145B09053059BEB00EFA5C15934FBBF4AF44348F10891DE898AB281D7B99548CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: e3d26237c5e129f4b8dc384cc51770ebccf14432f0a058bc797907c54c869385
Instruction ID: 012213b2b02f3db4e16211d5a2618c0f0beba23899dbc112933408f09f9a925f
Opcode Fuzzy Hash: e3d26237c5e129f4b8dc384cc51770ebccf14432f0a058bc797907c54c869385
Instruction Fuzzy Hash: C63123B09042449BEB20AF69C58032EB6E0BF49354F56893FD9C5E77E1C67E8DC0974A

Uniqueness

Uniqueness Score: -1.00%

Function 00402ECF Relevance: 9.0, APIs: 6, Instructions: 47networkCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402F1F
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F24
WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F2D
fprintf.MSVCRT ref: 00402F51
fprintf.MSVCRT ref: 00402F6B
fflush.MSVCRT ref: 00402F7B

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: fprintf$ErrorLast$fflush
String ID:
API String ID: 1179342926-0
Opcode ID: 1507f440a48880477d309dd62419c95f9a5d188ea55d3f880cd1ddb13ec90a23
Instruction ID: aedba044920dac11781e30089c66d1c72976f9705aae3b5046c65b340d9c2235
Opcode Fuzzy Hash: 1507f440a48880477d309dd62419c95f9a5d188ea55d3f880cd1ddb13ec90a23
Instruction Fuzzy Hash: 6B11B9B05043069FD740EF29DA8954A7BF0EF44388F01892EF889EB391D778D8548F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402F82 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F1F
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F24
Part of subcall function 00402ECF: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,00402FC6), ref: 00402F2D
Part of subcall function 00402ECF: fprintf.MSVCRT ref: 00402F51
Part of subcall function 00402ECF: fflush.MSVCRT ref: 00402F7B

shutdown.WSOCK32 ref: 00402FD6
closesocket.WSOCK32 ref: 00402FE6
_sleep.MSVCRT ref: 00402FF5
exit.MSVCRT ref: 00403001
_errno.MSVCRT ref: 0040300C

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: ErrorLastfprintf$_errno_sleepclosesocketexitfflushshutdown
String ID:
API String ID: 3984783896-0
Opcode ID: 6e9c7c120c1affb8180beccbe2b3cfc04695f91e07880b9eef69a37c199af21d
Instruction ID: 3542e69b3411e4e71ba3b63367d5401c8d3bb16ff36ee3f3bbffff72c4001994
Opcode Fuzzy Hash: 6e9c7c120c1affb8180beccbe2b3cfc04695f91e07880b9eef69a37c199af21d
Instruction Fuzzy Hash: C211CCB49083059FC700FF69D645649BBF4BB44344F01482EF8C4A7391E7B8E8948B9B

Uniqueness

Uniqueness Score: -1.00%

Function 004041AB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402F82: shutdown.WSOCK32 ref: 00402FD6
Part of subcall function 00402F82: closesocket.WSOCK32 ref: 00402FE6
Part of subcall function 00402F82: _sleep.MSVCRT ref: 00402FF5
Part of subcall function 00402F82: exit.MSVCRT ref: 00403001
Part of subcall function 00402F82: _errno.MSVCRT ref: 0040300C

sprintf.MSVCRT ref: 004042C9
_write.MSVCRT ref: 00404388

Strings

N, xrefs: 00404239

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _errno_sleep_writeclosesocketexitshutdownsprintf
String ID: N
API String ID: 941380402-1130791706
Opcode ID: 37b05e5afd40601c5a73a3549bd8d9f3e12d6401dcb359f71d3e62110ca999fc
Instruction ID: 68083ad8bac51fe3905405b462c0b6f67bb4a1db247556006c561e3c8f4ebfcf
Opcode Fuzzy Hash: 37b05e5afd40601c5a73a3549bd8d9f3e12d6401dcb359f71d3e62110ca999fc
Instruction Fuzzy Hash: 4971C4B4E0424ACFCB01DF98C6446AEBBF0BF55304F1481A6D951BB392C3789A52DF66

Uniqueness

Uniqueness Score: -1.00%

Function 00404F3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00404F3C
atoi.MSVCRT ref: 00404F54

Part of subcall function 00402F82: shutdown.WSOCK32 ref: 00402FD6
Part of subcall function 00402F82: closesocket.WSOCK32 ref: 00402FE6
Part of subcall function 00402F82: _sleep.MSVCRT ref: 00402FF5
Part of subcall function 00402F82: exit.MSVCRT ref: 00403001
Part of subcall function 00402F82: _errno.MSVCRT ref: 0040300C

Strings

3, xrefs: 00404E21

Memory Dump Source

Source File: 00000000.00000002.650029112.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.650019894.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.650044935.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nc.jbxd

Yara matches

Similarity

API ID: _errno$_sleepatoiclosesocketexitshutdown
String ID: 3
API String ID: 1965425864-1842515611
Opcode ID: f0a7008b52452b5db2457fb5b3bdcb433ce73af9d45da533742d5288b72da504
Instruction ID: 9e18031511e0b90bc96fffc2f7724399808eaf037f08a3e26671e6fc7f0f7b20
Opcode Fuzzy Hash: f0a7008b52452b5db2457fb5b3bdcb433ce73af9d45da533742d5288b72da504
Instruction Fuzzy Hash: C60117B0904308DFD700EFA9DA8465EBBF1EB54300F11893EE494BB291D7789950DF1A

Uniqueness

Uniqueness Score: -1.00%

Source: Yara match	File source: nc.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.650038928.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.377888447.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nc.exe PID: 6828, type: MEMORYSTR

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: nc.exePID: 6828, Parent PID: 3524

General

File Activities

File Opened

File Created

File Written

File Read

File Attributes Queried

Volume Information Queried

Windows Analysis Report
nc.exe

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON