Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1310751
MD5:	eeda5350767db40425db9c5f477f39f7
SHA1:	93614f3e1a9484df453f29c4c658ccdf3270841d
SHA256:	046edea2e16ee4e7e52c8a88294272ed2893adaf46e057e3f45d0efdef288c85
Tags:	exe
Infos:

Detection

Poverty Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (changes PE section rights)

Yara detected Poverty Stealer

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Snort IDS alert for network traffic

Query firmware table information (likely to detect VMs)

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

AV process strings found (often used to terminate AV products)

Yara signature match

Sample file is different than original file name gathered from version info

One or more processes crash

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to call native functions

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Classification

Process Tree

System is w10x64

file.exe (PID: 6992 cmdline: C:\Users\user\Desktop\file.exe MD5: EEDA5350767DB40425DB9C5F477F39F7)

WerFault.exe (PID: 7104 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 74572 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Poverty Stealer

{"C2 url": "69.46.15.167:2220"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000000.00000003.350274075.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6533:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.8b0e67.1.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.3.file.exe.8c0000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.3.file.exe.8c0000.0.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.2.file.exe.8b0e67.1.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Click to see the 1 entries

Snort Signatures

ET TROJAN [ANY.RUN] PovertyStealer Check-In via TCP - Source IP: 192.168.2.3 - Destination IP: 69.46.15.167

Timestamp:	192.168.2.369.46.15.1674971022202047066 09/19/23-14:28:00.763272
SID:	2047066
Source Port:	49710
Destination Port:	2220
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.8b0e67.1.unpack

Malware Configuration Extractor: Poverty Stealer {"C2 url": "69.46.15.167:2220"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 45%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004033C0 CryptUnprotectData,CryptProtectData,		0_2_004033C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B3627 CryptProtectData,		0_2_008B3627

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404EE0 FindFirstFileW,LoadLibraryA,	0_2_00404EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402F50 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00402F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405D70 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00405D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileW,DeleteFileW,DeleteFileW,FindNextFileW,FindNextFileW,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B5147 FindFirstFileW,	0_2_008B5147

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2047066 ET TROJAN [ANY.RUN] PovertyStealer Check-In via TCP 192.168.2.3:49710 -> 69.46.15.167:2220

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 69.46.15.167:2220

Source: global traffic

TCP traffic: 192.168.2.3:49710 -> 69.46.15.167:2220

Source: Joe Sandbox View

ASN Name: HVC-ASUS HVC-ASUS

Source: Joe Sandbox View

IP Address: 69.46.15.167 69.46.15.167

Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167
Source: unknown	TCP traffic detected without corresponding DNS query: 69.46.15.167

Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: file.exe, 00000000.00000002.372681218.00000000009E8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_da062dad-f

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe, 00000000.00000000.349585067.0000000000708000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHungle.exe8 vs file.exe
Source: file.exe, 00000000.00000002.372691723.0000000000A4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHungle.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameHungle.exe8 vs file.exe

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 74572

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421847	0_2_00421847
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F031	0_2_0041F031
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420433	0_2_00420433
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FEE2	0_2_0041FEE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F991	0_2_0041F991
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDF86	0_2_008BDF86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDF57	0_2_008BDF57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A09518	0_2_00A09518
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0955B	0_2_00A0955B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405370 VirtualAlloc,NtClose,NtClose,GetCurrentProcess,	0_2_00405370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401100 NtClose,OpenProcess,GetCurrentProcess,GetFileType,CloseHandle,GetCurrentProcess,CloseHandle,CloseHandle,CloseHandle,	0_2_00401100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403F10 NtClose,OpenProcess,GetCurrentProcess,GetFileType,CloseHandle,GetCurrentProcess,CloseHandle,CloseHandle,CloseHandle,	0_2_00403F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B55D7 VirtualAlloc,NtClose,NtClose,GetCurrentProcess,	0_2_008B55D7

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A06561 CreateToolhelp32Snapshot,Module32First,KiUserExceptionDispatcher,

0_2_00A06561

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 74572

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6992
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\LMR-003-

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER70E0.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@0/1

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A09BC7 pushad ; iretd

0_2_00A09BC8

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-10406

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A0955B rdtsc

0_2_00A0955B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004044D0 FindNextFileW,RegQueryInfoKeyW,GetCurrentHwProfileA,FindNextFileW,GetSystemInfo,GetPhysicallyInstalledSystemMemory,__aulldiv,GetModuleFileNameW,GetDC,GetCurrentObject,GetObjectW,DeleteObject,ReleaseDC,GetKeyboardLayoutList,

0_2_004044D0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404EE0 FindFirstFileW,LoadLibraryA,	0_2_00404EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402F50 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00402F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405D70 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00405D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileW,DeleteFileW,DeleteFileW,FindNextFileW,FindNextFileW,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B5147 FindFirstFileW,	0_2_008B5147

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.3.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.374767942.0000000009934000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404EC0 mov eax, dword ptr fs:[00000030h]	0_2_00404EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B0D90 mov eax, dword ptr fs:[00000030h]	0_2_008B0D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B092B mov eax, dword ptr fs:[00000030h]	0_2_008B092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B5127 mov eax, dword ptr fs:[00000030h]	0_2_008B5127
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A05E3E push dword ptr fs:[00000030h]	0_2_00A05E3E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00403570 GetProcessHeap,RtlFreeHeap,

0_2_00403570

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A0955B rdtsc

0_2_00A0955B

Source: Amcache.hve.3.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information

Yara detected Poverty Stealer

Source: Yara match	File source: 0.2.file.exe.8b0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.8c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.350274075.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Remote Access Functionality

Yara detected Poverty Stealer

Source: Yara match	File source: 0.2.file.exe.8b0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.8c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.350274075.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	2 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	HEUR/AGEN.1312455
file.exe	45%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
69.46.15.167:2220	0%	Avira URL Cloud	safe
69.46.15.167:2220	3%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
69.46.15.167:2220	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://search.yahoo.com?fr=crmas_sfp	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.3.dr	false	high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	file.exe, 00000000.00000002.394584693.000000000E247000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.386794218.000000000C689000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
69.46.15.167	unknown	United States		29802	HVC-ASUS	true

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1310751
Start date and time:	2023-09-19 14:27:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 24 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): www.bing.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, tse1.mm.bing.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:28:03	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
69.46.15.167	Setup_Loader_v2.1.exe	Get hash	malicious	Poverty Stealer	Browse
	o3GRLOXW1Y.exe	Get hash	malicious	Unknown	Browse
	6GL20vaVB0.exe	Get hash	malicious	Poverty Stealer	Browse
	6GL20vaVB0.exe	Get hash	malicious	Poverty Stealer	Browse
	NzS5VdbENI.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.DropperX-gen.10510.20091.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HVC-ASUS	https://link.emlmind.com/en/us1_link_tracker?hash=6dqbek7mb64844ifhdfqn75f3t4sfjw9na6kziino8i63uum5t9mg8amooqah88azqp431tpx7xb9bkj3i4hgay63ieqf1mhhazncxuboztaes363oqhwre9zghuircfw5p7asymgfwa1m7xnwuq44sotmxj1uzwmo8weja8fcez6o3m4pbqgyht19crot7nwjkrqrpw93n57jc1k8zttmaw5ugetc9ykj3xk314ay6w9i6hx3wcrmk6i71khhkc6sjdk3rea47uxxpw3huz5smkank17kqrxhpy3cwmokufs1oyrrdhi15o8efr9gibr&url=aHR0cHM6Ly9hZTcyMmQ5Yi5jODgzODUxMTIyN2RhZmNiY2NjMmZjOGQud29ya2Vycy5kZXYv&uid=NjAxNTY2MQ~~&ucs=edb1a7c5458f06ecfc28003cdd0e2c89	Get hash	malicious	HTMLPhisher	Browse	23.227.199.74
	OC-Order-confirmation,xlm.exe	Get hash	malicious	AgentTesla	Browse	23.111.168.178
	PI_Galanz_MWO_-2023-9-8,pdf.exe	Get hash	malicious	AgentTesla	Browse	23.111.168.178
	07.09.2023-08.09.2023PDF______________________________________.exe	Get hash	malicious	AgentTesla	Browse	23.111.168.178
	pcVd3eVrGG.exe	Get hash	malicious	AgentTesla	Browse	23.111.168.178
	Setup_Loader_v2.1.exe	Get hash	malicious	Poverty Stealer	Browse	69.46.15.167
	E-DEKONT1,DOC.exe	Get hash	malicious	AgentTesla, RedLine	Browse	23.111.168.178
	https://www.bing.com/ck/a?!&&p=087b5b448f3ec50dJmltdHM9MTY5NDM5MDQwMCZpZ3VpZD0wNzEzN2I5MS0zYmJkLTZlZWYtMzUxNS02OTJkM2ExNzZmYzImaW5zaWQ9NTE5MA&ptn=3&hsh=3&fclid=07137b91-3bbd-6eef-3515-692d3a176fc2&psq=https%3a%2f%2fbluepuppy.pet&u=a1aHR0cHM6Ly9ibHVlcHVwcHkucGV0Lw#Z2F5dGFudC5zdGlqbkBkZW1lLWdyb3VwLmNvbQ==	Get hash	malicious	Unknown	Browse	199.167.144.242
	o3GRLOXW1Y.exe	Get hash	malicious	Unknown	Browse	69.46.15.167
	New_Order.pdf.exe	Get hash	malicious	AgentTesla	Browse	209.133.204.178
	Oj2dR65c44.elf	Get hash	malicious	Mirai	Browse	23.227.187.95
	conhost.exe	Get hash	malicious	Unknown	Browse	66.206.0.82
	WlLa7joUe4.exe	Get hash	malicious	AgentTesla	Browse	209.133.204.178
	SecuriteInfo.com.Win32.PWSX-gen.5315.13582.exe	Get hash	malicious	AgentTesla	Browse	209.133.204.178
	9AgakTYFh7.exe	Get hash	malicious	AgentTesla	Browse	209.133.204.178
	https://cresten.cresten.online/?GCDZ=rI	Get hash	malicious	HTMLPhisher	Browse	37.1.211.71
	https://wolterskluwer.wolterskluwercom.us/?qSkAp=4ETBc	Get hash	malicious	HTMLPhisher	Browse	37.1.209.184
	5EVPHXZeyQ.exe	Get hash	malicious	AgentTesla	Browse	66.206.22.18
	CGAiKMbZJS.exe	Get hash	malicious	AgentTesla	Browse	209.133.204.178
	rFYI.exe	Get hash	malicious	AgentTesla	Browse	66.232.107.36

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_b881744bd24da49122ae106c74712cdb27f74121_9f84cedb_1b91792d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8430992069287914
Encrypted:	false
SSDEEP:	192:d6GQm4cWvcu3HQ0l0I3jGu/u7syS274ItmFBa:2pXQ0lTjf/u7syX4ItUa
MD5:	E8C8CC321E832FDC5C14B6B44C82290A
SHA1:	AEEBB1C7CB5FB5EA0FC27C404E505EDAD7C730E8
SHA-256:	BE9C5E6CBEB54177B0F422BA0672A8DD3849A9FD0E62F05DA0D14356DEA19119
SHA-512:	1FA1468CE51938673276351973DDC6B93477EEFDC35C3D03AA0E3FC6C8075B95A09220C9151463634B49B606D70B1093696E1F66B7E56D0B7B3C334C7599DF14
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.9.6.0.0.0.8.1.0.8.1.4.2.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.9.6.0.0.0.8.1.6.9.0.7.9.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.d.a.8.1.b.3.-.9.e.6.a.-.4.1.9.b.-.9.8.a.e.-.6.2.a.f.2.9.5.6.5.a.b.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.b.a.e.f.4.b.-.4.5.f.0.-.4.2.6.f.-.8.7.9.5.-.5.3.7.a.9.f.8.c.1.1.a.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.0.-.0.0.0.1.-.0.0.2.7.-.a.4.c.0.-.a.a.b.5.f.4.e.a.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.9.3.6.1.4.f.3.e.1.a.9.4.8.4.d.f.4.5.3.f.2.9.c.4.c.6.5.8.c.c.d.f.3.2.7.0.8.4.1.d.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70E0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 19 12:28:01 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	1037888
Entropy (8bit):	2.348483192869241
Encrypted:	false
SSDEEP:	3072:cNsDmNPQVXBMDT4SYTD/gFJedWhAGDzYtYCtxv2TK1NEWNYenRqb:cnKmH4TuwJGmc0NZYUM
MD5:	087B930973E68C311D0B044238335EF2
SHA1:	27BF916A83BF894E0193CC66003164A6DC62FC7E
SHA-256:	C004CD99AC9B0D724FFCC10732DD968C468B2CDB42C0800C6E5A566166C35146
SHA-512:	904C75ED982B696D44B6BB5C6579879347CEA8462F7B6082DFE166EC19267F9D0B224BFBD9641D35D5D24A05F38AA06310E3BACE97CD385C574554BF765D65C5
Malicious:	false
Reputation:	low
Preview:	MDMP....... .........e........................4................+..........T.......8...........T............V..(............................................................................................U...........B..............GenuineIntelW...........T.......P.....e.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7248.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	3.702830708695516
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNisC56uFx66YyPSU68lOgmfBisS3+pD+89bgssf9eAm:RrlsNiN6uFx66YaSU68cgmfAsSUg/f2
MD5:	D6ECC99A7F9B4B657002F3BF83848BB8
SHA1:	52C56658763248D30A1C764F6638227ED01BD8AF
SHA-256:	730BFE2BD08ACE48961D291AE0A35099C2A6720B08496024FA98BDA5F673E667
SHA-512:	78F5B7B352CF82F82A5B8E25439A64E4D9075EE5574D1E5BFC18148B128710F85341ECCA996466F64E7EF3BEBBDC16D8AF86620DF600E1B07A48C2501C60E6E8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7288.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.483077553980328
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLrJgtWI9f/Wgc8sqYjA8fm8M4JakFVT+q8oTvaqrg76A89d:uITfLFIugrsqYxJxTJaqrg76AKd
MD5:	1723FEE5390E19DA1D5D5F7B3A6167DC
SHA1:	00D83451CCDDC187902A443912515812EFF7E432
SHA-256:	5A60746776303B3DC6B297915AAAB145421500DB6D1A5AADA67D602E83513C7E
SHA-512:	040366E21B05FC8364F484E6DE0023945B93C03CEE3D27447607D8E2E43BC9024543CE5BFD549F8974FFEDCF061022776ACB445E0C3C733E7B6223B5FA361CF9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2224658" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.374285386966342
Encrypted:	false
SSDEEP:	12288:AFcTQC4Lh9c+g1Ep7yMZK8yrWzte7y/5rmZrmQ0ithr7+i+invToKdw+d:qcTQC4Lh9c+g1Eag7
MD5:	A06821F27C966E105C17B8CC8096D5D3
SHA1:	61F28FA80B9988E8952EBAF5DAACA4985EA2880E
SHA-256:	C77E5E6A62C37D7E029A3450BFDF3DE4415D28916177619B513238D1911295E1
SHA-512:	3D25FC1509D04D2BEBC2DD42C6B749E2970A01461C0B841859548D5B33620085D4CA4649E11625AC15BEE4413FFE6132878321ABB99DE8A42ADC87D749A58450
Malicious:	false
Reputation:	low
Preview:	regf........p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmj....................................................................................................................................................................................................................................................................................................................................................7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.291629069127215
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	253'440 bytes
MD5:	eeda5350767db40425db9c5f477f39f7
SHA1:	93614f3e1a9484df453f29c4c658ccdf3270841d
SHA256:	046edea2e16ee4e7e52c8a88294272ed2893adaf46e057e3f45d0efdef288c85
SHA512:	a80eee56773bf4bd6c3352430e4b5a87c7e409e9c1157a593c8c29cf4b3973482ced805c135a5c409ce1ae1716af4c91143ab2054389b5034bb5b4a13c1235f5
SSDEEP:	3072:QJxeK7W6OTYqgg85NM768yG+BFjR4U/RjUTcz3oQ9kt:A7W6OJ85q768y/BFjGU/JUcoQ
TLSH:	E244C021B7F1D831E1A75A3050B1C6B22A3B7C6255B5C98B63941B3F5E307C1BFAA316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^...?.].?.].?.].Ic].?.].IV].?.].Ib].?.].G[].?.].?.]^?.].Ig].?.].IR].?.].IU].?.]Rich.?.]................PE..L......c...........

File Icon


Icon Hash:	c73601d0b0222d02

Static PE Info

General

Entrypoint:	0x4035ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x63A50FCC [Fri Dec 23 02:17:48 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	82fc6aa150be346f557bda3dbcb8fac7

Entrypoint Preview

Instruction
call 00007F380D0410F3h
jmp 00007F380D03E13Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [00437008h+ecx*8]
je 00007F380D03E2C5h
inc ecx
cmp ecx, 2Dh
jc 00007F380D03E2A3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007F380D03E2C0h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0043700Ch+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007F380D040D6Ah
test eax, eax
jne 00007F380D03E2B8h
mov eax, 00437170h
ret
add eax, 08h
ret
call 00007F380D040D57h
test eax, eax
jne 00007F380D03E2B8h
mov eax, 00437174h
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007F380D03E297h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007F380D03E237h
pop ecx
mov esi, eax
call 00007F380D03E271h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword ptr [ebp+08h]
test ecx, ecx
je 00007F380D03E2CDh
push FFFFFFE0h
xor edx, edx
pop eax
div ecx
cmp eax, dword ptr [ebp+0Ch]
jnc 00007F380D03E2C1h
call 00007F380D03E24Fh
mov dword ptr [eax], 0000000Ch
xor eax, eax
pop ebp
ret
imul ecx, dword ptr [ebp+0Ch]
push esi
mov esi, ecx
test esi, esi
jne 00007F380D03E2B3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3598c	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x308000	0x3f40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d88	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ec	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x354d0	0x35600	False	0.5114991949648712	data	5.520650305414998	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x37000	0x2d09e4	0x4400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x308000	0x3f40	0x4000	False	0.45892333984375	data	4.046779794577083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3081c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.44398340248962653
RT_ICON	0x30a768	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.47827868852459016
RT_STRING	0x30b320	0x28e	data	0.4954128440366973
RT_STRING	0x30b5b0	0x284	data	0.47360248447204967
RT_STRING	0x30b838	0x706	data	0.42102335928809786
RT_GROUP_ICON	0x30b0f0	0x22	data	0.9705882352941176
RT_VERSION	0x30b118	0x208	data	0.5346153846153846

Imports

DLL	Import
KERNEL32.dll	MoveFileExA, ReadConsoleA, InterlockedDecrement, SetDefaultCommConfigW, GetEnvironmentStringsW, SetConsoleScreenBufferSize, AddConsoleAliasW, SetVolumeMountPointW, GetComputerNameW, GetSystemDefaultLCID, GetModuleHandleW, GetCommConfig, GetConsoleAliasesLengthA, GetConsoleAliasExesW, GetDriveTypeA, GetEnvironmentStrings, GlobalAlloc, GetPrivateProfileIntA, LoadLibraryW, TerminateThread, ReadConsoleInputA, CopyFileW, SetConsoleCP, DeleteVolumeMountPointW, EnumSystemCodePagesA, LocalReAlloc, GetACP, GetVolumePathNameA, FindFirstFileW, DisconnectNamedPipe, CreateJobObjectA, GetNamedPipeHandleStateW, GetStartupInfoA, FindFirstFileA, GetLastError, GetCurrentDirectoryW, GetProcessVersion, LoadLibraryA, GetFileType, RemoveDirectoryW, FindAtomA, FindNextFileA, EnumDateFormatsA, SetLocaleInfoW, FreeEnvironmentStringsW, FindNextFileW, VirtualProtect, PurgeComm, FatalAppExitA, GetShortPathNameW, ReadConsoleInputW, FindAtomW, GetWindowsDirectoryW, FindFirstVolumeW, EnumSystemLocalesW, CreateFileW, CloseHandle, SetInformationJobObject, GetPrivateProfileSectionNamesW, CreateMailslotW, GetCommandLineW, WriteConsoleW, MoveFileA, HeapAlloc, EncodePointer, DecodePointer, HeapReAlloc, HeapSetInformation, GetStartupInfoW, GetProcAddress, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, Sleep, HeapSize, EnterCriticalSection, LeaveCriticalSection, HeapFree, SetFilePointer, SetHandleCount, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, GetCPInfo, GetOEMCP, IsValidCodePage, WideCharToMultiByte, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, IsProcessorFeaturePresent, LCMapStringW, MultiByteToWideChar, GetStringTypeW, RaiseException
USER32.dll	CharUpperW
GDI32.dll	SelectPalette, GetTextFaceW, GetCharWidthA
SHELL32.dll	DragFinish

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.369.46.15.1674971022202047066 09/19/23-14:28:00.763272	TCP	2047066	ET TROJAN [ANY.RUN] PovertyStealer Check-In via TCP	49710	2220	192.168.2.3	69.46.15.167

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2023 14:28:00.629488945 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.762746096 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.762911081 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.763272047 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.763272047 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.895087004 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.895128965 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.895210981 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.895222902 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.895325899 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.895433903 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.895503998 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.895546913 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.895606995 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.896277905 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.896311045 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.896342993 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.896372080 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.896455050 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:00.896480083 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.896480083 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.896480083 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.896480083 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:00.896653891 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.027100086 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027192116 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027240038 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027251959 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.027283907 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027359009 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027390957 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027396917 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.027429104 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.027442932 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.027631044 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.027693987 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.028332949 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.028366089 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.028424025 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.028424025 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.028570890 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.028644085 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.028824091 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.028884888 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.028973103 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.029030085 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.069616079 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.069796085 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.159173012 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.159285069 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.159287930 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.159399986 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.159404993 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.159455061 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.159605026 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.159773111 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.159833908 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.159912109 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.160044909 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.160099983 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.160309076 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.160366058 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.160455942 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.160523891 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.160706043 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.160758972 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.160954952 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161014080 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161272049 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161304951 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161341906 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161355019 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161355019 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161413908 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161465883 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161523104 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161616087 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161669016 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161686897 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161736965 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161796093 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161839008 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.161906958 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.161962986 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162017107 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162079096 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162204981 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162262917 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162277937 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162308931 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162333012 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162364960 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162420034 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162477970 CEST	49710	2220	192.168.2.3	69.46.15.167
Sep 19, 2023 14:28:01.162529945 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.162640095 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.201411963 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.201466084 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.291055918 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.291114092 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.291147947 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.291256905 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.291517973 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292227030 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292548895 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292582989 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292615891 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292674065 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292705059 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292737961 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292768955 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292798042 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292830944 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292864084 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292895079 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292931080 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292962074 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.292994022 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293024063 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293173075 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293287992 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293370962 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293466091 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293560982 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293656111 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293759108 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293859959 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.293967962 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294101000 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294200897 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294298887 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294414043 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294518948 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294636965 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294737101 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294853926 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.294981956 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295089006 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295187950 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295295000 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295464993 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295568943 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295641899 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295720100 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295844078 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.295958996 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296057940 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296178102 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296257973 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296402931 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296508074 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296626091 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296715021 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296845913 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.296951056 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.337519884 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.391109943 CEST	2220	49710	69.46.15.167	192.168.2.3
Sep 19, 2023 14:28:01.391288996 CEST	49710	2220	192.168.2.3	69.46.15.167

Target ID:	0
Start time:	14:27:52
Start date:	19/09/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	253'440 bytes
MD5 hash:	EEDA5350767DB40425DB9C5F477F39F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000003.350274075.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:28:00
Start date:	19/09/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 74572
Imagebase:	0x1080000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	81.3%
Signature Coverage:	19.4%
Total number of Nodes:	680
Total number of Limit Nodes:	7

Executed Functions

Function 004044D0 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040466F
GetSystemInfo.KERNELBASE(?), ref: 0040469F
GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004046FF
__aulldiv.LIBCMT ref: 00404714
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000208), ref: 00404730
GetDC.USER32(00000000), ref: 00404738
GetCurrentObject.GDI32(?,00000007), ref: 00404747
GetObjectW.GDI32(?,00000018,?), ref: 0040475A
DeleteObject.GDI32(?), ref: 00404779
ReleaseDC.USER32 ref: 00404785

Strings

{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}, xrefs: 0040467E
Microsoft Basic Display Adapter, xrefs: 004046E0
Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, xrefs: 004045FB, 00404646
C:\Users\user\Desktop\file.exe, xrefs: 00404729

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Object$CurrentSystem$DeleteFileInfoInstalledMemoryModuleNamePhysicallyProfileRelease__aulldiv
String ID: C:\Users\user\Desktop\file.exe$Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz$Microsoft Basic Display Adapter${e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}
API String ID: 2273077324-3386605023
Opcode ID: 0407204a2e67d83a7e96f79ef5b5304d4161a3dc4db49db4a002a0ba96b8ec8a
Instruction ID: f95703c44cdd768557f20c2002d8bf7661732abb907082ca4a8db72876e69e67
Opcode Fuzzy Hash: 0407204a2e67d83a7e96f79ef5b5304d4161a3dc4db49db4a002a0ba96b8ec8a
Instruction Fuzzy Hash: 86A1BEB0E00209EBDB04DFA5D841BADBBB4EF98304F10887EE605B72D0E7795951CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401710 Relevance: 13.4, APIs: 4, Strings: 3, Instructions: 1174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403E00: GetFileAttributesW.KERNELBASE(@@,?,?,004040E9,?), ref: 00403E08

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

FindFirstFileW.KERNELBASE(?,?), ref: 00401777
FindNextFileW.KERNELBASE(000000FF,?), ref: 00402A7D

Strings

',r, xrefs: 004026D8
%ws\%ws, xrefs: 004017F8
x0I, xrefs: 00401EE6, 00401EEC

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalFindHeapSection$AllocateAttributesEnterFirstLeaveNextProcess
String ID: %ws\%ws$',r$x0I
API String ID: 674214967-835861565
Opcode ID: f4dce2c9328b5233167f3361de0ce32c4e30747dd64a3b8f7fc060b2459a89c9
Instruction ID: 391ef23385abac8a4148d01b1526362d678f2bb4c14d673990be2d9f219d9000
Opcode Fuzzy Hash: f4dce2c9328b5233167f3361de0ce32c4e30747dd64a3b8f7fc060b2459a89c9
Instruction Fuzzy Hash: F5B26E71E14218DAEB14DFA4DC41BEEB375EF58304F1084A9E10CBB391E67A9E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402F50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00A14B90,?), ref: 00402F95

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

FindNextFileW.KERNELBASE(000000FF,?), ref: 004033A2

Strings

%ws%ws, xrefs: 00403342
%ws\%ws, xrefs: 00403012

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalFileFindHeapSection$AllocateEnterFirstLeaveNextProcess
String ID: %ws%ws$%ws\%ws
API String ID: 3555643018-2023498393
Opcode ID: cb8740596861bbb1564a735129fa3bd479aa1a827e59d9f44eae97eef24e1154
Instruction ID: f7da82c17ef2bf09f0cc3b7df4c00458ec30bb3023b3a8a00e10236260fc77ac
Opcode Fuzzy Hash: cb8740596861bbb1564a735129fa3bd479aa1a827e59d9f44eae97eef24e1154
Instruction Fuzzy Hash: 56C1B061E1020896EB14DBA5E841BEE7379EF58304F00857EE508FB3A1FB3A9A54C759

Uniqueness

Uniqueness Score: -1.00%

Function 00405370 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 421
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040,?,00404DAE), ref: 0040538E
GetCurrentProcess.KERNEL32(00000000), ref: 004053D1

Strings

cE, xrefs: 00405A42

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocCurrentProcessVirtual
String ID: cE
API String ID: 1355094253-163553156
Opcode ID: d18c9acba386cd91f9e98f90d1d9feffd6c4d9877cde36b0e887f70e5be8399d
Instruction ID: 6c779c1105b918cdaa462d111dde94121fdb9daa6e18740b44916a1253f0f40a
Opcode Fuzzy Hash: d18c9acba386cd91f9e98f90d1d9feffd6c4d9877cde36b0e887f70e5be8399d
Instruction Fuzzy Hash: 8F02D2307016008AF7188B25C5297676222EF90B04F5096BED169AF7E6D77DCD22CB8F

Uniqueness

Uniqueness Score: -1.00%

Function 00405D70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403E00: GetFileAttributesW.KERNELBASE(@@,?,?,004040E9,?), ref: 00403E08

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

FindFirstFileW.KERNELBASE(00000000,?), ref: 00405DD7
FindNextFileW.KERNELBASE(000000FF,?), ref: 00405FA9

Strings

%ws\%ws, xrefs: 00405E3A

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalFindHeapSection$AllocateAttributesEnterFirstLeaveNextProcess
String ID: %ws\%ws
API String ID: 674214967-3197343109
Opcode ID: 0e847981d9539d29dab535b6e7bf93a129ad9c27c2364c30b5f2f155dac372ca
Instruction ID: 23d4d1715e34f215830b39906fe81c0077f27e4625ee614edcb56dca3be27f20
Opcode Fuzzy Hash: 0e847981d9539d29dab535b6e7bf93a129ad9c27c2364c30b5f2f155dac372ca
Instruction Fuzzy Hash: 5E61F3B5D04208A7DB00DFA5DC41AAF77B8EF44305F1484BEF548A72C2E6399B158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004033C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,-00000005), ref: 004033F4
CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,-00000005), ref: 00403432

Strings

Poverty is the parent of crime., xrefs: 00403414

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CryptData$ProtectUnprotect
String ID: Poverty is the parent of crime.
API String ID: 3358631343-459368448
Opcode ID: d4143964ca4384b1c13305824362e6d05fb34c821f536e753f076ceb60ab8675
Instruction ID: 6e5abc115a5e9d136f9da075d7246080ecdc0d8531dc0069451ba7c9591d53ce
Opcode Fuzzy Hash: d4143964ca4384b1c13305824362e6d05fb34c821f536e753f076ceb60ab8675
Instruction Fuzzy Hash: AD112135A00218BBDB04CF98CC41FEEBB79FB85310F50856AEA15BB2C0D774AA05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A06561 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A06589
Module32First.KERNEL32(00000000,00000224), ref: 00A065A9

Memory Dump Source

Source File: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d53e48a617da55571e3be121a2d97d2c605b202245196c0099fb9041d7bbc3d0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: BFF096315007196FD7203BF9BC8DBAE76ECAF49728F100528E642914C0DB70FC554A61

Uniqueness

Uniqueness Score: -1.00%

Function 00403570 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00404E8B,009F3250), ref: 0040357F
RtlFreeHeap.NTDLL(00000000,?,00404E8B,009F3250), ref: 00403586

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 30e6b73eaab0a2952156bf055a34b3ae76f272313430007368f5ba6a1d788146
Instruction ID: d7b11d41ac067d1c2742b3bdfba4256e401789511bebdcde65a4697e1a1844fe
Opcode Fuzzy Hash: 30e6b73eaab0a2952156bf055a34b3ae76f272313430007368f5ba6a1d788146
Instruction Fuzzy Hash: E4C01231400208EBD7005FD4DD0CBA57B6C9704346F008020FA0CA61A0C674D584CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404EE0 Relevance: 1.6, APIs: 1, Instructions: 137libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000000,?,?,?,?,?,?,?,004050D2), ref: 00404F36

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ced5de2966c16d9e3dba5c2597b097740b47aa5a489c41392578e8e11f4eaeed
Instruction ID: ee5d22ec325391a361f41379e54844ebaa4da1900d84c89b746596d4027696f1
Opcode Fuzzy Hash: ced5de2966c16d9e3dba5c2597b097740b47aa5a489c41392578e8e11f4eaeed
Instruction Fuzzy Hash: 19512CB4D04119DFDB04CF98C4A0BAEBBF1EF84304F1480AAD551AB382C739AA85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404A40 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 200
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404A63
socket.WS2_32(?,00000001,00000000), ref: 00404A9E
connect.WS2_32(000000FF,?,00000010), ref: 00404C84
send.WS2_32(000000FF,84b52718-9e34-4c47-9efc-4e502155d85e,00000437,00000000), ref: 00404CA9
send.WS2_32(000000FF,000000FF,0000002F,00000000), ref: 00404CCF
Sleep.KERNEL32(000003E8), ref: 00404CDD
closesocket.WS2_32(000000FF), ref: 00404CFA

Strings

gametools, xrefs: 00404B85
111, xrefs: 00404C29
@, xrefs: 00404B12
gametools, xrefs: 00404B8A
0, xrefs: 00404BED
%d,%d,%d,%d,a%d,%d,%d,%d, xrefs: 00404AEC
84b52718-9e34-4c47-9efc-4e502155d85e, xrefs: 00404B9E, 00404C92
0, xrefs: 00404C1A
0, xrefs: 00404BC0
., xrefs: 00404B6C
84b52718-9e34-4c47-9efc-4e502155d85e, xrefs: 00404B99

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: send$SleepStartupclosesocketconnectsocket
String ID: %d,%d,%d,%d,a%d,%d,%d,%d$.$0$0$0$111$84b52718-9e34-4c47-9efc-4e502155d85e$84b52718-9e34-4c47-9efc-4e502155d85e$@$gametools$gametools
API String ID: 4285724308-351856712
Opcode ID: 1e83a8a122139c377f586724cbee5ed2d8e0bac46524fa933d686979d05b723a
Instruction ID: 16db693c6c969251986c864a8d8d3cbd4138a9ef300cd020343e65b521247af7
Opcode Fuzzy Hash: 1e83a8a122139c377f586724cbee5ed2d8e0bac46524fa933d686979d05b723a
Instruction Fuzzy Hash: 8E7156B0A04104ABE708CBA5DD55BBE7B79AFC4300F2481BAE604BF3C1D2B99E50C758

Uniqueness

Uniqueness Score: -1.00%

Function 00404B3A Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 124
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(000000FF,?,00000010), ref: 00404C84
send.WS2_32(000000FF,84b52718-9e34-4c47-9efc-4e502155d85e,00000437,00000000), ref: 00404CA9
send.WS2_32(000000FF,000000FF,0000002F,00000000), ref: 00404CCF
Sleep.KERNEL32(000003E8), ref: 00404CDD
closesocket.WS2_32(000000FF), ref: 00404CFA

Strings

gametools, xrefs: 00404B85
111, xrefs: 00404C29
@, xrefs: 00404B12
gametools, xrefs: 00404B8A
1, xrefs: 00404C11
84b52718-9e34-4c47-9efc-4e502155d85e, xrefs: 00404B9E, 00404C92
1, xrefs: 00404BB7
84b52718-9e34-4c47-9efc-4e502155d85e, xrefs: 00404B99
1, xrefs: 00404BE4

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: send$Sleepclosesocketconnect
String ID: 1$1$1$111$84b52718-9e34-4c47-9efc-4e502155d85e$84b52718-9e34-4c47-9efc-4e502155d85e$@$gametools$gametools
API String ID: 4223982704-3976769646
Opcode ID: 72ddca90887ebf1c9032b2c4fb3ff0ad75baaa490d8bbd201062aee328199846
Instruction ID: 26d48490503fff8eea378d019275d89596d083aea46842c49e36e17a5ee5e9e0
Opcode Fuzzy Hash: 72ddca90887ebf1c9032b2c4fb3ff0ad75baaa490d8bbd201062aee328199846
Instruction Fuzzy Hash: 42414BB06080049BE708CB69C950BBD7B769BC5300F2486BAE214BF3D1C279DE61D75D

Uniqueness

Uniqueness Score: -1.00%

Function 004040D0 Relevance: 16.8, APIs: 8, Strings: 3, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403E00: GetFileAttributesW.KERNELBASE(@@,?,?,004040E9,?), ref: 00403E08

EnterCriticalSection.KERNEL32(0040E180), ref: 0040416E
LeaveCriticalSection.KERNEL32(0040E180), ref: 004041BB
EnterCriticalSection.KERNEL32(0040E180), ref: 00404314
LeaveCriticalSection.KERNEL32(0040E180), ref: 00404353
EnterCriticalSection.KERNEL32(0040E180), ref: 0040439C
LeaveCriticalSection.KERNEL32(0040E180), ref: 004043E3
EnterCriticalSection.KERNEL32(0040E180), ref: 00404488
LeaveCriticalSection.KERNEL32(0040E180), ref: 004044B4

Part of subcall function 00403F10: OpenProcess.KERNEL32(00000040,00000000,?), ref: 00403FCC
Part of subcall function 00403F10: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00403FEE
Part of subcall function 00403F10: GetFileType.KERNEL32(000000FF), ref: 0040402E

Strings

\??\%ws, xrefs: 00404106
\??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State, xrefs: 004040F5, 0040410B, 00404118
@, xrefs: 0040414E

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$FileProcess$AttributesCurrentOpenType
String ID: @$\??\%ws$\??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State
API String ID: 201629988-4135269365
Opcode ID: f6d3259441f57a08ba0c66ecedf04f6568fb199f383866d7992f87bc402ff705
Instruction ID: 233d002cd56207b0f9b4dc3ec9bb6522c754bbf464353a14dba4981cbbde8731
Opcode Fuzzy Hash: f6d3259441f57a08ba0c66ecedf04f6568fb199f383866d7992f87bc402ff705
Instruction Fuzzy Hash: 8AB1C0B4E00208EBEB10CFA1D845BAEB775EF88704F108529E505BB3C1D7799A55CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404D20 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,LMR-003-111-P), ref: 00404D34
GetLastError.KERNEL32 ref: 00404D47
InitializeCriticalSectionAndSpinCount.KERNEL32(0040E180,00001E01), ref: 00404D62
DeleteCriticalSection.KERNEL32(0040E180), ref: 00404E79

Part of subcall function 00405370: VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040,?,00404DAE), ref: 0040538E
Part of subcall function 00405370: GetCurrentProcess.KERNEL32(00000000), ref: 004053D1

CreateThread.KERNELBASE ref: 00404E02
CreateThread.KERNELBASE ref: 00404E1C
CreateThread.KERNELBASE ref: 00404E36
WaitForMultipleObjects.KERNEL32(00000003,?,00000001,000000FF), ref: 00404E49

Part of subcall function 00404A40: WSAStartup.WS2_32(00000202,?), ref: 00404A63
Part of subcall function 00404A40: socket.WS2_32(?,00000001,00000000), ref: 00404A9E

Part of subcall function 00403570: GetProcessHeap.KERNEL32(00000000,00000000,?,00404E8B,009F3250), ref: 0040357F
Part of subcall function 00403570: RtlFreeHeap.NTDLL(00000000,?,00404E8B,009F3250), ref: 00403586

Strings

LMR-003-111-P, xrefs: 00404D2B

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Create$Thread$CriticalHeapProcessSection$AllocCountCurrentDeleteErrorFreeInitializeLastMultipleMutexObjectsSpinStartupVirtualWaitsocket
String ID: LMR-003-111-P
API String ID: 4133941914-797279375
Opcode ID: 7ae5db80789d283892a9c153a22fb0bcb73e804ee8d60d7a49a1133312877cce
Instruction ID: 170a5ccbe1781f8fc1d389477b3402a28932d328956110bf6c124a642a8f410b
Opcode Fuzzy Hash: 7ae5db80789d283892a9c153a22fb0bcb73e804ee8d60d7a49a1133312877cce
Instruction Fuzzy Hash: 6A4198B1E40204ABE710DBA1ED06FAE7774AB44705F104539FA08772D1E778A908CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 008B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 008B024D

Strings

kernel32.dll, xrefs: 008B008F, 008B0095
cess, xrefs: 008B018D

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0fdea2b578a004e139404501eb08fb367d617787f9fca6d9d9b2aee9f5418c3f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: E4526874A012299FDB64CF58C984BA9BBB1BF09304F1480E9E94DAB351DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6A0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 361
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,0070686C), ref: 0041C7FA

Strings

t^:, xrefs: 0041C9DD

Memory Dump Source

Source File: 00000000.00000002.372583600.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_file.jbxd

Similarity

API ID: AllocGlobal
String ID: t^:
API String ID: 3761449716-1317908726
Opcode ID: 26836b13f233095548e7e8767e78901c862f527461d55b569fbced6fec92ff15
Instruction ID: 1aa6a8640389b5813f3f68f19352c2cab43cb2a8ee3d2139d40dd4c81a61a424
Opcode Fuzzy Hash: 26836b13f233095548e7e8767e78901c862f527461d55b569fbced6fec92ff15
Instruction Fuzzy Hash: F1D1CD716C4344BBF350AB91DD8AF5937A4EB44B01F10403AF789BA5E0D6F46984CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C799 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 285
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,0070686C), ref: 0041C7FA
VirtualProtect.KERNELBASE(00440DFC,0070686C,00000040,?), ref: 0041CA32
LoadLibraryA.KERNELBASE(0043C068), ref: 0041CAA8

Strings

t^:, xrefs: 0041C9DD

Memory Dump Source

Source File: 00000000.00000002.372583600.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_file.jbxd

Similarity

API ID: AllocGlobalLibraryLoadProtectVirtual
String ID: t^:
API String ID: 1263758589-1317908726
Opcode ID: 1c95d482b29cc829393ce32e361dc03256f96975ec041af07a67bdae48e234e1
Instruction ID: f64e39110550a32180f51a84cf44b81d5c7a5a599cf11c0b68cdfe27368ffb40
Opcode Fuzzy Hash: 1c95d482b29cc829393ce32e361dc03256f96975ec041af07a67bdae48e234e1
Instruction Fuzzy Hash: DCB18971684344EBE3109F90EE8AF9977A4FB44B01F108526F785BA5E0D7B46884CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403530 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID:
API String ID: 1367039788-0
Opcode ID: 51d9cabb7f51bd8f68d26aefdd08daf424fbc9846409ac88fca74241acb23cb4
Instruction ID: d03b1218f6db39d4e0ea1f79d35053aa653235b1eabe4e26975e9452da2ef5a7
Opcode Fuzzy Hash: 51d9cabb7f51bd8f68d26aefdd08daf424fbc9846409ac88fca74241acb23cb4
Instruction Fuzzy Hash: D2E0C278E40208FFE7009FD0DE0D9687BA8EB0C305F004461FD0CA2240CA709D0A8B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF60 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0040E180,?,?,?,?,?,?,?,?,?,?,?,0040C1E7,00000000,?,00000000), ref: 0040BF6B
LeaveCriticalSection.KERNEL32(0040E180,?,?,?,?,?,?,?,?,?,?,?,0040C1E7), ref: 0040BF91
LeaveCriticalSection.KERNEL32(0040E180), ref: 0040BFCC

Part of subcall function 00403570: GetProcessHeap.KERNEL32(00000000,00000000,?,00404E8B,009F3250), ref: 0040357F
Part of subcall function 00403570: RtlFreeHeap.NTDLL(00000000,?,00404E8B,009F3250), ref: 00403586

LeaveCriticalSection.KERNEL32(0040E180,?,?,?,?,?,?,?,?,00000003), ref: 0040C18D

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Heap$EnterFreeProcess
String ID:
API String ID: 2223192847-0
Opcode ID: b0fe354d7f4ecbf5a1f2af5e73ec57aae7db1da13cd5814ec88a8fd8a777a3b5
Instruction ID: c9483220be1b29621597449c8acc6be0275a18916525e68a7ca52970bde799aa
Opcode Fuzzy Hash: b0fe354d7f4ecbf5a1f2af5e73ec57aae7db1da13cd5814ec88a8fd8a777a3b5
Instruction Fuzzy Hash: 6D711074A00209EFCB04DF94D981AAEB7B5FF48304F148569F909AB391D7349E45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004042D9 Relevance: 5.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0040E180), ref: 00404314
LeaveCriticalSection.KERNEL32(0040E180), ref: 00404353
EnterCriticalSection.KERNEL32(0040E180), ref: 0040439C
LeaveCriticalSection.KERNEL32(0040E180), ref: 004043E3
EnterCriticalSection.KERNEL32(0040E180), ref: 00404488
LeaveCriticalSection.KERNEL32(0040E180), ref: 004044B4

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocateProcess
String ID:
API String ID: 4148517753-0
Opcode ID: a4dc46155340f4e730613e68d11d17b2c7b3fa7d84d5ef02707da3958b1fa990
Instruction ID: 8a1a12ff2a48980f07d7f736d937d9940b1318255f7c41e280a62138209a90ff
Opcode Fuzzy Hash: a4dc46155340f4e730613e68d11d17b2c7b3fa7d84d5ef02707da3958b1fa990
Instruction Fuzzy Hash: 4141E1B0E00308EBDB14CFA1CC45BAEB775FB88704F10896AE611BA2C1D7795645CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403E00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(@@,?,?,004040E9,?), ref: 00403E08

Strings

@@, xrefs: 00403E04, 00403E07

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: @@
API String ID: 3188754299-1653905929
Opcode ID: 5cabb0733c0374d102225fa8efd0b51622dcea8957433c8c6e068a9ac0be8701
Instruction ID: 70c0842cc4f2fd47db523d4b365ffe37f5c593160b96cad823cdc561254d3772
Opcode Fuzzy Hash: 5cabb0733c0374d102225fa8efd0b51622dcea8957433c8c6e068a9ac0be8701
Instruction Fuzzy Hash: 3CD05E70809108E7CB00CF98D90879D7BBC9B04325F204395F818A72C0C379DF555BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00402122 Relevance: 3.2, APIs: 2, Instructions: 157fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 004022D1
FindNextFileW.KERNELBASE(000000FF,?), ref: 00402A7D

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$DeleteFindNext
String ID:
API String ID: 918895714-0
Opcode ID: bfb4492a2c97c338c1193278cfc2cc1e451d3e5ee37e682d500a4256e9f60d24
Instruction ID: a9b38581b9f5e2af640ed4a08d11583c120f7bdae4d7d02a9cace8dc40330def
Opcode Fuzzy Hash: bfb4492a2c97c338c1193278cfc2cc1e451d3e5ee37e682d500a4256e9f60d24
Instruction Fuzzy Hash: 9B619FB0D042589BEB10CBA5D954BEEB7B5EF58304F1044BDE508BB3D1D7BA8A80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 008B0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,008B0223,?,?), ref: 008B0E19
SetErrorMode.KERNELBASE(00000000,?,?,008B0223,?,?), ref: 008B0E1E

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c8ee7785ec40c83d6f57f546c265962584c58f89b5ad5e99698589515ecd4ea5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 5ED0123114512877D7002A94DC09BCE7B1CDF05B62F008411FB0DD9180C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040294E Relevance: 1.6, APIs: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(000000FF,?), ref: 00402A7D

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 072e2c57f1f4c7ffb3555e70ac4fb021623f177394cadb4a91a03bcc9d71300f
Instruction ID: 967f0f8756ce382391e2010d6228bff57261670077a873627ae2a563e97d8f7f
Opcode Fuzzy Hash: 072e2c57f1f4c7ffb3555e70ac4fb021623f177394cadb4a91a03bcc9d71300f
Instruction Fuzzy Hash: C1315C70A181689AEB14CB64C850BEEB372EF59300F0050E9E54CEB3A1E6795E90CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00A06220 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A06271

Memory Dump Source

Source File: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 94a101267d5b0f0616e2f1d1de162fd7073d76dcacaf24313aa906a0b3b4b142
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1D113C79A00208EFDB01DF98CA85E98BBF5AF08751F058094F9489B362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401100 Relevance: 12.1, APIs: 8, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

OpenProcess.KERNEL32(00000040,00000000,?), ref: 004011BC
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 004011DE
GetFileType.KERNEL32(000000FF), ref: 0040121E
CloseHandle.KERNEL32(000000FF), ref: 00401241
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000001), ref: 00401251
CloseHandle.KERNEL32(000000FF), ref: 00401289
CloseHandle.KERNEL32(00000000), ref: 0040129A
CloseHandle.KERNEL32(00000000), ref: 004012A6

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$CriticalCurrentHeapSection$AllocateEnterFileLeaveOpenType
String ID:
API String ID: 1542303429-0
Opcode ID: f6c87a539dfa72355f260533f684e7efd8583d3e00dfb6a3342fd27d32a4be87
Instruction ID: 8e9a20c15c72bff634c72a78754b3217163a8ee98a141fbf8363607e7f657408
Opcode Fuzzy Hash: f6c87a539dfa72355f260533f684e7efd8583d3e00dfb6a3342fd27d32a4be87
Instruction Fuzzy Hash: 27513EB5E00209EFDB14CFD4DD44BAEB7B9BB48304F104169E615BB2D4D7389A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403F10 Relevance: 12.1, APIs: 8, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00403530: EnterCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 00403539
Part of subcall function 00403530: GetProcessHeap.KERNEL32(00000008,00405272,?,?,00405272,00000208), ref: 00403545
Part of subcall function 00403530: RtlAllocateHeap.NTDLL(00000000,?,?,00405272,00000208), ref: 0040354C
Part of subcall function 00403530: LeaveCriticalSection.KERNEL32(0040E180,?,?,00405272,00000208), ref: 0040355A

OpenProcess.KERNEL32(00000040,00000000,?), ref: 00403FCC
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00403FEE
GetFileType.KERNEL32(000000FF), ref: 0040402E
CloseHandle.KERNEL32(000000FF), ref: 0040404D
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000001), ref: 0040405D
CloseHandle.KERNEL32(000000FF), ref: 00404095
CloseHandle.KERNEL32(00000000), ref: 004040A6
CloseHandle.KERNEL32(00000000), ref: 004040B2

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$CriticalCurrentHeapSection$AllocateEnterFileLeaveOpenType
String ID:
API String ID: 1542303429-0
Opcode ID: f5b203630af429c5b22260a68f736c2fcbec229ff287be812919e718faf10da1
Instruction ID: abdecdd355210c94ed0d7ef6c451ccbce21182920f42216e88442e2660da4c49
Opcode Fuzzy Hash: f5b203630af429c5b22260a68f736c2fcbec229ff287be812919e718faf10da1
Instruction Fuzzy Hash: 8E5151B1D00209EFDB14CFD8CD44BAEB7B9AB88304F104569E215BB2D0D7799A45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 008B55D7 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 421memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000020,00003000,00000040,?,008B5015), ref: 008B55F5
GetCurrentProcess.KERNEL32(00000000), ref: 008B5638

Strings

cE, xrefs: 008B5CA9

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AllocCurrentProcessVirtual
String ID: cE
API String ID: 1355094253-163553156
Opcode ID: 131d8fbaf52e4aacefb1ca881fda82ba2867afc8e4ff3a223c6b3db2e92c1f5d
Instruction ID: 24ac87105f526182b5e386d6924cb90aa6bb79386cefefaa56c51338a930eed8
Opcode Fuzzy Hash: 131d8fbaf52e4aacefb1ca881fda82ba2867afc8e4ff3a223c6b3db2e92c1f5d
Instruction Fuzzy Hash: EC02D23061060087F7188B35C12D7BA6222FF90B04F5496BDD169DFBE6DB79C922C78A

Uniqueness

Uniqueness Score: -1.00%

Function 008B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 008B0966
., xrefs: 008B095F
GetProcAddress., xrefs: 008B09DC, 008B09DF, 008B09E4

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 61eb064abd2f97f60d2e3233172b424a25ed13047e52e2dc11221790a43d3415
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 0A3117B6900619DFDB10CF99C880AEEBBF5FB48324F25414AD441E7351D771AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 008B3627 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,?), ref: 008B3699

Strings

Poverty is the parent of crime., xrefs: 008B367B

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CryptDataProtect
String ID: Poverty is the parent of crime.
API String ID: 3091777813-459368448
Opcode ID: d4143964ca4384b1c13305824362e6d05fb34c821f536e753f076ceb60ab8675
Instruction ID: 3cbe7b24745f9776e9f1e6e953d4de0d7d1c69f3dd6b956400ee19ed34b78d04
Opcode Fuzzy Hash: d4143964ca4384b1c13305824362e6d05fb34c821f536e753f076ceb60ab8675
Instruction Fuzzy Hash: 77114475A00218BBDB04CF98CC41FEEB779FB99710F108569EA15AB3C0D770AA04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00A09518 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733767e90f28cf9fa209a80896cfd3694955e122320fc68d413aad28ccb36ed3
Instruction ID: 7e2e4e840c6d9744d1fce5cae1dd435411cd954607492837183d073cc2dd4738
Opcode Fuzzy Hash: 733767e90f28cf9fa209a80896cfd3694955e122320fc68d413aad28ccb36ed3
Instruction Fuzzy Hash: 3A8176B25693899FC3068F78EC961E37FA1EF57314B1805DDD4908F1A3E6269417CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00A0955B Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9753ea3043e502ebe55b8ba787f2ffd76f3daabc9858a27ef7ef996b04cb9ed
Instruction ID: 3f272058c30a33b7e3cba0f4e525db0bfec089e12bbb3d9a34d6f4ef3b98e159
Opcode Fuzzy Hash: c9753ea3043e502ebe55b8ba787f2ffd76f3daabc9858a27ef7ef996b04cb9ed
Instruction Fuzzy Hash: 336143B64663899FC7068F38EC961D77FB1EF57318B6814D9C4808F163E622A407DB91

Uniqueness

Uniqueness Score: -1.00%

Function 008B5147 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3b9fd9301a22d3de611e37c3fecbb0355f5607246e4d9618f88d1ade5c2f8d
Instruction ID: dc508fabba81987a4277c226d29a48ef77c309eeff722cf2d9805f2b7d2e156d
Opcode Fuzzy Hash: 6f3b9fd9301a22d3de611e37c3fecbb0355f5607246e4d9618f88d1ade5c2f8d
Instruction Fuzzy Hash: D5513774D04119AFDB08CF98C491BEEBBF1FF49308F1480A9D951AB392C775AA81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A05E3E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372688011.0000000000A00000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 55710bfdb1cf1de67c78ee9c5e636aadd9b8443c7fd9bd4e66b48bbffc7a23fb
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2D11C2727405049FD744CF65EC81FA773EAEB88360B298055ED08CB341E675ED01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 008B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 5fefef4fe29634cb6bb1f178c77fef3bc052991d2a7d67ed0ad67b88818bceb7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: A701A276A006048FDF21CF64C805BEB33E5FB86316F5945A5D90AD7391E774A9418F90

Uniqueness

Uniqueness Score: -1.00%

Function 008BDF86 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0734f66c746c75eb04e7d9580fd22f43b52c7d22f6abfdddb15326e3d8a7dd6
Instruction ID: 996e8c5117d4177d3ccccccab83f49465e5c9e5c7149023c01fb92f5381cea96
Opcode Fuzzy Hash: e0734f66c746c75eb04e7d9580fd22f43b52c7d22f6abfdddb15326e3d8a7dd6
Instruction Fuzzy Hash: E6F0659281D3D13FA762EAB4049A5A3BFD1764324434BDDEEC5419B553EA208047B3C2

Uniqueness

Uniqueness Score: -1.00%

Function 008BDF57 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a88e8bf70f81f21f5d8115bb18535d9954857786cc332dc0272fde5ec97f570
Instruction ID: acb9a085a138d8ad5e0510ddfe7da8e33e6ce5c69f5517c805f06a663255bbf3
Opcode Fuzzy Hash: 7a88e8bf70f81f21f5d8115bb18535d9954857786cc332dc0272fde5ec97f570
Instruction Fuzzy Hash: 83E0927242C3517FAB61ADB441851937BD1A743344357A8EDC141AB412E9308447B3C1

Uniqueness

Uniqueness Score: -1.00%

Function 008B5127 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Uniqueness

Uniqueness Score: -1.00%

Function 00404EC0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Uniqueness

Uniqueness Score: -1.00%

Function 008B4337 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 270COMMON

Download Yara Rule

APIs

Part of subcall function 008B4067: GetFileAttributesW.KERNEL32(008B1550,?,?,008B1550,?), ref: 008B406F

RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B43D5
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B4422
RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B457B
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B45BA
RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B4603
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B464A
RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B46EF
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B471B

Strings

\??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State, xrefs: 008B435C, 008B4372, 008B437F
@, xrefs: 008B43B5

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AttributesFile
String ID: @$\??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State
API String ID: 1320886263-3544443730
Opcode ID: ff5c832f2408d1daefc49f7896c2b8b144615d5a798c709d2e25dde031fd0526
Instruction ID: 53f5b326587a48493cee0c932f4d2bd2ab28263e54aa64e252f4580e89f7c6c3
Opcode Fuzzy Hash: ff5c832f2408d1daefc49f7896c2b8b144615d5a798c709d2e25dde031fd0526
Instruction Fuzzy Hash: 19B1A174E00208EBEB14CFA4D846BEE7771FF58700F108528E504EB381D77A9A55CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00406440 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 376COMMON

Download Yara Rule

Strings

(null), xrefs: 004065CC
0123456789abcdef, xrefs: 004066BB
(null), xrefs: 004064F1
0123456789ABCDEF, xrefs: 004066B2

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (null)$(null)$0123456789ABCDEF$0123456789abcdef
API String ID: 0-1267642376
Opcode ID: 4c356fb5d5d8c95d00141f1f3a8287f21bac98838fd882f1a7378106d59b9684
Instruction ID: 0f9fa89e4bb1acb399efe6d468b8bfcb7991c3a550fdf07217e8f19a8632a6ac
Opcode Fuzzy Hash: 4c356fb5d5d8c95d00141f1f3a8287f21bac98838fd882f1a7378106d59b9684
Instruction Fuzzy Hash: 0D02CA74A00209EFCB04CF58D590BADBBB2FF48304F25C56AE806AB394C735AE91DB55

Uniqueness

Uniqueness Score: -1.00%

Function 008B4F87 Relevance: 12.1, APIs: 8, Instructions: 120threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,0040E26D), ref: 008B4F9B
GetLastError.KERNEL32 ref: 008B4FAE
InitializeCriticalSectionAndSpinCount.KERNEL32(0040E180,00001E01), ref: 008B4FC9
RtlDeleteCriticalSection.NTDLL(0040E180), ref: 008B50E0

Part of subcall function 008B55D7: VirtualAlloc.KERNEL32(00000000,00000020,00003000,00000040,?,008B5015), ref: 008B55F5
Part of subcall function 008B55D7: GetCurrentProcess.KERNEL32(00000000), ref: 008B5638

CreateThread.KERNEL32(00000000,00000000,00402F50,?,00000000,00000000), ref: 008B5069
CreateThread.KERNEL32(00000000,00000000,00402A90,?,00000000,00000000), ref: 008B5083
CreateThread.KERNEL32(00000000,00000000,00405FD0,?,00000000,00000000), ref: 008B509D
WaitForMultipleObjects.KERNEL32(00000003,?,00000001,000000FF), ref: 008B50B0

Part of subcall function 008B37D7: GetProcessHeap.KERNEL32(00000000,00000000), ref: 008B37E6
Part of subcall function 008B37D7: HeapFree.KERNEL32(00000000), ref: 008B37ED

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Create$Thread$CriticalHeapProcessSection$AllocCountCurrentDeleteErrorFreeInitializeLastMultipleMutexObjectsSpinVirtualWait
String ID:
API String ID: 1036980007-0
Opcode ID: bcb5c1e57dab3d49e4a7d3f8574e49763282264c78b863ad9f8538fc4529f769
Instruction ID: 2cd7c6e1c5d4f59f4a17a230aaf6dc0d6047fbd9cd09d9cacc355cfa6f01ce33
Opcode Fuzzy Hash: bcb5c1e57dab3d49e4a7d3f8574e49763282264c78b863ad9f8538fc4529f769
Instruction Fuzzy Hash: 4E4183B1E40204ABE710DB94DD06FEE7778FB44700F104434FA09B63D0DA759909CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 008B4737 Relevance: 10.7, APIs: 7, Instructions: 236COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 008B497B
GetModuleFileNameW.KERNEL32(00000000,0040E29F,00000208), ref: 008B4997
GetDC.USER32(00000000), ref: 008B499F
GetCurrentObject.GDI32(?,00000007), ref: 008B49AE
GetObjectW.GDI32(?,00000018,?), ref: 008B49C1
DeleteObject.GDI32(?), ref: 008B49E0
ReleaseDC.USER32(00000000,?), ref: 008B49EC

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Object$CurrentDeleteFileModuleNameRelease__aulldiv
String ID:
API String ID: 2286704243-0
Opcode ID: 0cc418bdd18285d6d32df7ac9944fa68292c4ff33d780f037c74295a2ca43fb1
Instruction ID: 94da4649a336850d7def42b002f882b2981253e6e59180adc5f8cd66c8273b60
Opcode Fuzzy Hash: 0cc418bdd18285d6d32df7ac9944fa68292c4ff33d780f037c74295a2ca43fb1
Instruction Fuzzy Hash: 66A198B0A002199BEB04CFA5D842BEDBBB4FF48304F109469E609F7391EB745A51CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 008B4CA7 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 200sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 008B4F44

Strings

@, xrefs: 008B4D79
111, xrefs: 008B4E90
0, xrefs: 008B4E81
., xrefs: 008B4DD3
0, xrefs: 008B4E54
0, xrefs: 008B4E27

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: .$0$0$0$111$@
API String ID: 3472027048-572483225
Opcode ID: 159d0f1b6d08e07750d3a3e32510e190e74df9d6fb5c026aabeb73ae57e0bf0f
Instruction ID: e91edaab8df7b23d9738e01eff7e96c61f3837341d6efdab9d6fdc25c63ca5b9
Opcode Fuzzy Hash: 159d0f1b6d08e07750d3a3e32510e190e74df9d6fb5c026aabeb73ae57e0bf0f
Instruction Fuzzy Hash: E5710570A041089AE718CBA9CD56BFDBB75FF84300F2485A8E614EF3C2D6B59E50C755

Uniqueness

Uniqueness Score: -1.00%

Function 004068A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 390COMMON

Download Yara Rule

APIs

IsDBCSLeadByte.KERNEL32(?), ref: 00406ACE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,?,00000001), ref: 00406AE8
IsDBCSLeadByte.KERNEL32(?), ref: 00406B44
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,00000002), ref: 00406B76

Strings

x, xrefs: 00406C06

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Byte$CharLeadMultiWide
String ID: x
API String ID: 2561704868-2363233923
Opcode ID: e69aaaac0603ebfef08d3f47f7e5ea15235603ee742426351ac40fc6946a8042
Instruction ID: 6cecbc450f97827f75e97a1dc4a391dac297818cbbcd28653831cc4ab1e2fd33
Opcode Fuzzy Hash: e69aaaac0603ebfef08d3f47f7e5ea15235603ee742426351ac40fc6946a8042
Instruction Fuzzy Hash: 0002DBB0E04219DFCB04CF98C591AAEBBB1FF49304F14816AE856BB354D734AA51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 008BC1C7 Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0040E180), ref: 008BC1D2
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008BC1F8
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008BC233

Part of subcall function 008B37D7: GetProcessHeap.KERNEL32(00000000,00000000), ref: 008B37E6
Part of subcall function 008B37D7: HeapFree.KERNEL32(00000000), ref: 008B37ED

RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008BC3F4

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Heap$EnterFreeProcess
String ID:
API String ID: 2223192847-0
Opcode ID: 45cf105668e53e985d64f316b3950ee3059e9ed6dfd61e78e0550ca36c51a9ce
Instruction ID: 8ab3c74220f4963c6d0f67073fffb6a488801ba92670ed76ded683d5eec4e7bc
Opcode Fuzzy Hash: 45cf105668e53e985d64f316b3950ee3059e9ed6dfd61e78e0550ca36c51a9ce
Instruction Fuzzy Hash: 9A7119B4A00209EFCB04DF98D981AEEB7B1FF48304F14C558F909AB351D735AA45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 008B4540 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B457B
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B45BA
RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B4603
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B464A
RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B46EF
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B471B

Part of subcall function 008B3797: RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B37A0
Part of subcall function 008B3797: GetProcessHeap.KERNEL32(00000008,008B1385,?,?,008B1385,00001000), ref: 008B37AC
Part of subcall function 008B3797: RtlAllocateHeap.NTDLL(00000000), ref: 008B37B3
Part of subcall function 008B3797: RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B37C1

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocateProcess
String ID:
API String ID: 4148517753-0
Opcode ID: 835dac65a19b1ce1349f95ed64455aec13dcaeb3b2eef544cf05500428b4ff76
Instruction ID: 32774665feb62178b565cd3cdb686cf9c91b51b88346c0f666228b40e7c8485f
Opcode Fuzzy Hash: 835dac65a19b1ce1349f95ed64455aec13dcaeb3b2eef544cf05500428b4ff76
Instruction Fuzzy Hash: 3E41CE74E00308EBEB04CFA0C856BEEB7B1FF49704F108928E500AA382D7755649CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041E2E3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041E309

Part of subcall function 0041E135: __fltout2.LIBCMT ref: 0041E160

__cftog_l.LIBCMT ref: 0041E32F
__cftoe_l.LIBCMT ref: 0041E361

Memory Dump Source

Source File: 00000000.00000002.372583600.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: f6f3aced188d2654ddf67743fe828d95121b6f27d5806d0341e73ded57ca25bb
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 1911837640004DFBCF225F96CC05CEE3F66BB18394B198416FE2859131C73ACAB1AB85

Uniqueness

Uniqueness Score: -1.00%

Function 008B3797 Relevance: 6.0, APIs: 4, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0040E180), ref: 008B37A0
GetProcessHeap.KERNEL32(00000008,008B1385,?,?,008B1385,00001000), ref: 008B37AC
RtlAllocateHeap.NTDLL(00000000), ref: 008B37B3
RtlLeaveCriticalSection.NTDLL(0040E180), ref: 008B37C1

Memory Dump Source

Source File: 00000000.00000002.372668115.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID:
API String ID: 1367039788-0
Opcode ID: 51d9cabb7f51bd8f68d26aefdd08daf424fbc9846409ac88fca74241acb23cb4
Instruction ID: d03b1218f6db39d4e0ea1f79d35053aa653235b1eabe4e26975e9452da2ef5a7
Opcode Fuzzy Hash: 51d9cabb7f51bd8f68d26aefdd08daf424fbc9846409ac88fca74241acb23cb4
Instruction Fuzzy Hash: D2E0C278E40208FFE7009FD0DE0D9687BA8EB0C305F004461FD0CA2240CA709D0A8B79

Uniqueness

Uniqueness Score: -1.00%

Function 00401570 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 0040163B
%s\*, xrefs: 004015B2

Memory Dump Source

Source File: 00000000.00000002.372576838.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.372576838.0000000000410000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateAttributesEnterFileLeaveProcess
String ID: %s\%s$%s\*
API String ID: 3295714881-2848263008
Opcode ID: 8e5a15dbfa6556ae8ac79fcb8fdcd9d5c697ea9240cb10633434fdaa9da34813
Instruction ID: 308d2fca5881b34be8af7a30c03c4363a924540ae401d536cf9ca5417b20ff13
Opcode Fuzzy Hash: 8e5a15dbfa6556ae8ac79fcb8fdcd9d5c697ea9240cb10633434fdaa9da34813
Instruction Fuzzy Hash: 2D41B4F5D00209ABDB00EF94DC45BAE77B8AB44308F0449B9E509BB2D1E7399B44CB99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Poverty Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_b881744bd24da49122ae106c74712cdb27f74121_9f84cedb_1b91792d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70E0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7248.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7288.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
file.exe

Function 004044D0 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 236
COMMON

Function 00401710 Relevance: 13.4, APIs: 4, Strings: 3, Instructions: 1174
fileCOMMON

Function 00402F50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 300
fileCOMMON

Function 00405370 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 421
memoryCOMMON

Function 00405D70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178
fileCOMMON

Function 004033C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
encryptionCOMMON

Function 00404A40 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 200
networksleepCOMMON

Function 00404B3A Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 124
networksleepCOMMON

Function 004040D0 Relevance: 16.8, APIs: 8, Strings: 3, Instructions: 270
COMMON

Function 00404D20 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120
threadsynchronizationCOMMON

Function 008B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041C6A0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 361
memoryCOMMON

Function 0041C799 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 285
memorylibraryCOMMON

Function 00403530 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON