Edit tour

Windows Analysis Report
RevoUPort.exe

Overview

General Information

Sample Name:	RevoUPort.exe
Analysis ID:	1341997
MD5:	2f814a927d097a09911111dbf0fc2e93
SHA1:	8e4e953c60653a333182320345209765695d4e17
SHA256:	ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Uses 32bit PE files

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Classification

Process Tree

System is w10x64

RevoUPort.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\RevoUPort.exe" -install MD5: 2F814A927D097A09911111DBF0FC2E93)

RevoUPort.exe (PID: 3320 cmdline: "C:\Users\user\Desktop\RevoUPort.exe" /install MD5: 2F814A927D097A09911111DBF0FC2E93)

RevoUPort.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\RevoUPort.exe" /load MD5: 2F814A927D097A09911111DBF0FC2E93)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: RevoUPort.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RevoUPort.exe

Static PE information: certificate valid

Source:

Binary string: I:\Projects\RevoUninFreePort\Release\RevoUPort.pdb source: RevoUPort.exe

Source: RevoUPort.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: RevoUPort.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RevoUPort.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: RevoUPort.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: RevoUPort.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: RevoUPort.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: RevoUPort.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: RevoUPort.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: RevoUPort.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: RevoUPort.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: RevoUPort.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: RevoUPort.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: RevoUPort.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RevoUPort.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: RevoUPort.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: 0_2_00404BE2

0_2_00404BE2

Source: RevoUPort.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RevoUPort.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: clean4.winEXE@3/0@0/0

Source: unknown	Process created: C:\Users\user\Desktop\RevoUPort.exe "C:\Users\user\Desktop\RevoUPort.exe" -install
Source: unknown	Process created: C:\Users\user\Desktop\RevoUPort.exe "C:\Users\user\Desktop\RevoUPort.exe" /install
Source: unknown	Process created: C:\Users\user\Desktop\RevoUPort.exe "C:\Users\user\Desktop\RevoUPort.exe" /load

Source: C:\Users\user\Desktop\RevoUPort.exe	Command line argument: \x64\RevoUn.exe	0_2_00401090
Source: C:\Users\user\Desktop\RevoUPort.exe	Command line argument: \x86\RevoUn.exe	0_2_00401090
Source: C:\Users\user\Desktop\RevoUPort.exe	Command line argument: /@	0_2_00402F30

Source: RevoUPort.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 5

Perma Link

Source: RevoUPort.exe

Static PE information: certificate valid

Source: RevoUPort.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: I:\Projects\RevoUninFreePort\Release\RevoUPort.pdb source: RevoUPort.exe

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: 0_2_00403313 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00403313

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: 0_2_00402795 push ecx; ret

0_2_004027A8

Source: C:\Users\user\Desktop\RevoUPort.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-3240

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RevoUPort.exe

0_2_00403313

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: 0_2_004011CF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004011CF

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RevoUPort.exe	Code function: 0_2_004014D6 SetUnhandledExceptionFilter,	0_2_004014D6
Source: C:\Users\user\Desktop\RevoUPort.exe	Code function: 0_2_004052FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004052FB
Source: C:\Users\user\Desktop\RevoUPort.exe	Code function: 0_2_004011CF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004011CF
Source: C:\Users\user\Desktop\RevoUPort.exe	Code function: 0_2_00402BE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00402BE2

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: GetLocaleInfoA,

0_2_00406C1A

Source: C:\Users\user\Desktop\RevoUPort.exe

Code function: 0_2_0040293C GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0040293C

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RevoUPort.exe	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1341997
Start date and time:	2023-11-13 22:19:35 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Cmdline fuzzy
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	RevoUPort.exe
Detection:	CLEAN
Classification:	clean4.winEXE@3/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 6 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: RevoUPort.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8572569042608205
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RevoUPort.exe
File size:	205'440 bytes
MD5:	2f814a927d097a09911111dbf0fc2e93
SHA1:	8e4e953c60653a333182320345209765695d4e17
SHA256:	ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf
SHA512:	d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619
SSDEEP:	3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh
TLSH:	5314CF47BB60D836C816AE715DF2CC9A6A79BC203FA14D5B310DB2368B317877C1A25D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Df................L.......].......K.L...'...........N.....B......U\.......Y.....Rich............................PE..L...0..\...

File Icon


Icon Hash:	3f7b3cbc6465716d

Static PE Info

General

Entrypoint:	0x401384
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5C111530 [Wed Dec 12 14:03:28 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f1701f0b31fe827683fdfb65eb40b138

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/08/2018 01:00:00 06/08/2021 13:00:00
Subject Chain	CN=VS Revo Group Ltd., O=VS Revo Group Ltd., L=Ruse, C=BG, SERIALNUMBER=200204019, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=BG
Version:	3
Thumbprint MD5:	D4392CF7A0F073AB178B1586CD546135
Thumbprint SHA-1:	E0504D965BF65DC63E8A2DA7328A392EA3D6641E
Thumbprint SHA-256:	A1658A33836B151EF0A2784F29A6BD8180B0E4F6E3385596942BEC2FFF71A676
Serial:	0D7AAE3B360869A3BA28BD7D1FD0B8F6

Entrypoint Preview

Instruction
call 00007F57C0F09308h
jmp 00007F57C0F07BCEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0040AD58h], eax
mov dword ptr [0040AD54h], ecx
mov dword ptr [0040AD50h], edx
mov dword ptr [0040AD4Ch], ebx
mov dword ptr [0040AD48h], esi
mov dword ptr [0040AD44h], edi
mov word ptr [0040AD70h], ss
mov word ptr [0040AD64h], cs
mov word ptr [0040AD40h], ds
mov word ptr [0040AD3Ch], es
mov word ptr [0040AD38h], fs
mov word ptr [0040AD34h], gs
pushfd
pop dword ptr [0040AD68h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0040AD5Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0040AD60h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0040AD6Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0040ACA8h], 00010001h
mov eax, dword ptr [0040AD60h]
mov dword ptr [0040AC5Ch], eax
mov dword ptr [0040AC50h], C0000409h
mov dword ptr [0040AC54h], 00000001h
mov eax, dword ptr [0040A004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0040A008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000028h]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9624	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x25208	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2e600	0x3c80
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8130	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x92d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x62d4	0x6400	False	0.6128125	data	6.577573430174636	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1bec	0x1c00	False	0.3627232142857143	data	5.530177957664494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x18dc	0xe00	False	0.220703125	firmware 1200 v0 (revision 948256768) N\346@\273\261\031\277D\ \|\206@ V2, version 8704.0.49281 (region 318767104), 4102242304 bytes or less, UNKNOWN1 0x13000000, UNKNOWN2 0xac844000, UNKNOWN3 0x1c000000, at 0x1f000000 2424520704 bytes , at 0x20000000 1484996608 bytes , at 0x21000000 1619148800 bytes	2.301389499466089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc000	0x25208	0x25400	False	0.6203400272651006	data	6.794793308550795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc340	0xc301	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9996995252498948
RT_ICON	0x18644	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.38365077487282623
RT_ICON	0x28e6c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.5286372224846481
RT_ICON	0x2d094	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5776970954356846
RT_ICON	0x2f63c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7035647279549718
RT_ICON	0x306e4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8430851063829787
RT_MENU	0x30b4c	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x30b98	0x170	data	English	United States	0.5978260869565217
RT_STRING	0x30d08	0x44	data	English	United States	0.6323529411764706
RT_ACCELERATOR	0x30d4c	0x10	data	English	United States	1.25
RT_GROUP_ICON	0x30d5c	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x30db8	0x2e8	data	Bulgarian	Bulgaria	0.4583333333333333
RT_MANIFEST	0x310a0	0x165	ASCII text, with CRLF line terminators	English	United States	0.5434173669467787

Imports

DLL	Import
SHLWAPI.dll	PathQuoteSpacesW, PathRemoveFileSpecW
KERNEL32.dll	VirtualFree, GetModuleFileNameW, IsWow64Process, GetCurrentProcess, CreateProcessW, CloseHandle, GetStartupInfoW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, HeapCreate, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, HeapSize, GetLocaleInfoA, WideCharToMultiByte, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, LCMapStringA, LCMapStringW

DLL

Import

SHLWAPI.dll

PathQuoteSpacesW, PathRemoveFileSpecW

KERNEL32.dll

VirtualFree, GetModuleFileNameW, IsWow64Process, GetCurrentProcess, CreateProcessW, CloseHandle, GetStartupInfoW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, HeapCreate, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, HeapSize, GetLocaleInfoA, WideCharToMultiByte, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, LCMapStringA, LCMapStringW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Bulgarian	Bulgaria

• RevoUPort.exe
• RevoUPort.exe
• RevoUPort.exe

Click to jump to process

Click to jump to process

Behavior

• RevoUPort.exe
• RevoUPort.exe
• RevoUPort.exe

Click to jump to process

Target ID:	0
Start time:	22:20:21
Start date:	13/11/2023
Path:	C:\Users\user\Desktop\RevoUPort.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RevoUPort.exe" -install
Imagebase:	0x400000
File size:	205'440 bytes
MD5 hash:	2F814A927D097A09911111DBF0FC2E93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:20:23
Start date:	13/11/2023
Path:	C:\Users\user\Desktop\RevoUPort.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RevoUPort.exe" /install
Imagebase:	0x400000
File size:	205'440 bytes
MD5 hash:	2F814A927D097A09911111DBF0FC2E93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:20:25
Start date:	13/11/2023
Path:	C:\Users\user\Desktop\RevoUPort.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RevoUPort.exe" /load
Imagebase:	0x400000
File size:	205'440 bytes
MD5 hash:	2F814A927D097A09911111DBF0FC2E93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	1043
Total number of Limit Nodes:	33

Executed Functions

Function 00401090 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,00001000), ref: 004010D5
PathRemoveFileSpecW.SHLWAPI(?), ref: 004010E0
GetCurrentProcess.KERNEL32 ref: 004010F3
IsWow64Process.KERNEL32(00000000), ref: 004010FA
PathQuoteSpacesW.SHLWAPI(?), ref: 00401150
CreateProcessW.KERNELBASE ref: 0040119B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004011AC
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004011B3

Strings

D, xrefs: 00401193
\x64\RevoUn.exe, xrefs: 00401127
\x86\RevoUn.exe, xrefs: 00401141

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: Process$ChangeCloseFileFindNotificationPath$CreateCurrentModuleNameQuoteRemoveSpacesSpecWow64
String ID: D$\x64\RevoUn.exe$\x86\RevoUn.exe
API String ID: 1785292516-1518941810
Opcode ID: 2ba654dcb95702fdd477ff646e135533ec43e02b1d79f2762acddc1ce987f442
Instruction ID: e3c47da943e67759585446f3fcb147c3f02403bb67e2025d436041387088d013
Opcode Fuzzy Hash: 2ba654dcb95702fdd477ff646e135533ec43e02b1d79f2762acddc1ce987f442
Instruction Fuzzy Hash: BF317271508345ABD304DF64DD48B9B77E9BB88304F00893EF689E7291DB78D508CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401236 Relevance: 21.1, APIs: 14, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00401281
__mtinit.LIBCMT ref: 00401287
_fast_error_exit.LIBCMT ref: 00401292
__RTC_Initialize.LIBCMT ref: 00401298
__ioinit.LIBCMT ref: 004012A0
__amsg_exit.LIBCMT ref: 004012AB
GetCommandLineW.KERNEL32 ref: 004012B1
__wsetargv.LIBCMT ref: 004012C5
__amsg_exit.LIBCMT ref: 004012D0
__wsetenvp.LIBCMT ref: 004012D6
__amsg_exit.LIBCMT ref: 004012E1
__cinit.LIBCMT ref: 004012E8
__amsg_exit.LIBCMT ref: 004012F3
__wwincmdln.LIBCMT ref: 004012F9

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 2477803136-0
Opcode ID: 0a4131a3f09dafe98c2071d30180da013621fb1f76b8b55cc89fb1cde6469d7b
Instruction ID: 4afe02bc8aef5bd6e3ac1c47c09415ebe3fe9d4595586c94baeec2cf02c112f8
Opcode Fuzzy Hash: 0a4131a3f09dafe98c2071d30180da013621fb1f76b8b55cc89fb1cde6469d7b
Instruction Fuzzy Hash: 2E214F709003159AEB147BB29946B6E32A4AF4070DF10447FF905BE1F2EB7C8980865D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E84 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,004012C0), ref: 00401E87
__malloc_crt.LIBCMT ref: 00401EB5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00401EC2

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 0b341952edede550eb9a9cc578f1fe33d07ac7145760393dd49f8024d73315ef
Instruction ID: e7ea9710eb4eb87777bf120c467c03ab54746ad731670e047487c704668ecfe1
Opcode Fuzzy Hash: 0b341952edede550eb9a9cc578f1fe33d07ac7145760393dd49f8024d73315ef
Instruction Fuzzy Hash: 39F089776141505DDA117635BC4447F166DDB8632A312547BFC92E3291FA3C4D4782E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401568 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00401570

Part of subcall function 0040153D: GetModuleHandleW.KERNEL32(mscoree.dll,?,00401575,?,?,004055EE,000000FF,0000001E,?,004037FC,?,00000001,?,?,00402B2A,00000018), ref: 00401547
Part of subcall function 0040153D: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00401557

ExitProcess.KERNEL32 ref: 00401579

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 2cac4713ae5ac7ed1b6551de5003f55a04254346e2a782e40bf1ed2b7bb1ffcb
Instruction ID: 58d6b86d7dc910e8b4e62c479df394c06966c6199c3907ee712af7da7166dfdc
Opcode Fuzzy Hash: 2cac4713ae5ac7ed1b6551de5003f55a04254346e2a782e40bf1ed2b7bb1ffcb
Instruction Fuzzy Hash: 81B09231000148BBCB012F52ED0AC493F3AEB803E0B918079F8191A071DF72AED69AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040271E Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00402733

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: c4bc10c7c0858019f9aa7d7e1baf57dca7d049e5e0115054a649d4dc720c85e5
Instruction ID: 0f4c916b80aab31cefcda02e3c16a5d6d808ddaffd6ca2b0ffb18817546bfaa8
Opcode Fuzzy Hash: c4bc10c7c0858019f9aa7d7e1baf57dca7d049e5e0115054a649d4dc720c85e5
Instruction Fuzzy Hash: A6D05E32554348AEDB005F716E48B223BDCD384395F148436B84CD6190F674C580DA4C

Uniqueness

Uniqueness Score: -1.00%

Function 00401784 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00401790

Part of subcall function 00401658: __lock.LIBCMT ref: 00401666
Part of subcall function 00401658: __decode_pointer.LIBCMT ref: 0040169D
Part of subcall function 00401658: __decode_pointer.LIBCMT ref: 004016B2
Part of subcall function 00401658: __decode_pointer.LIBCMT ref: 004016DC
Part of subcall function 00401658: __decode_pointer.LIBCMT ref: 004016F2
Part of subcall function 00401658: __decode_pointer.LIBCMT ref: 004016FF
Part of subcall function 00401658: __initterm.LIBCMT ref: 0040172E
Part of subcall function 00401658: __initterm.LIBCMT ref: 0040173E

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 8edc4039e09adb1a4f660b1a2f0a800298a6dd6e46e0bba68154ad57ccebc67a
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: DFB0927258024873DB202543AC07F063A0D8BD0B64E290021FA0C2A5E1A9A3A9618089

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004011CF Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00401449
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040145E
UnhandledExceptionFilter.KERNEL32(0040814C), ref: 00401469
GetCurrentProcess.KERNEL32(C0000409), ref: 00401485
TerminateProcess.KERNEL32(00000000), ref: 0040148C

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c23ade69b3019443581d8e93dacde07fc42a1989e0575db2270c25edb4dfba9f
Instruction ID: 6605824e95379c9e6e13eab9d263395022ee6bfba2e6105a4e4436435c276b03
Opcode Fuzzy Hash: c23ade69b3019443581d8e93dacde07fc42a1989e0575db2270c25edb4dfba9f
Instruction Fuzzy Hash: AA21AFB5911304DFD710DF25EF456483BA5BF18316F11403AE908B6AB0EBB859A58F4E

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001494), ref: 004014DB

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8bcca18537da99e12e7c8836e546d653637cba3fd31f1ebc81b97cff2361adb8
Instruction ID: d9d5bd4f49d236e8b1c7fd3e97c0bd66a80e5dbddb1df7bcff4b9355bdb21dec
Opcode Fuzzy Hash: 8bcca18537da99e12e7c8836e546d653637cba3fd31f1ebc81b97cff2361adb8
Instruction Fuzzy Hash: 4E9002746515014AC65457709F0965925D05A5C70275604B56141E40B5DEB44005551D

Uniqueness

Uniqueness Score: -1.00%

Function 004022E8 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004093F8,0000000C,00402423,00000000,00000000,?,00401852,00000003,?,?,?,?,?,?,004011F9), ref: 004022FA
__crt_waiting_on_module_handle.LIBCMT ref: 00402305

Part of subcall function 004014E4: Sleep.KERNEL32(000003E8,00000000,?,0040224B,KERNEL32.DLL,?,00402297,?,00401852,00000003), ref: 004014F0
Part of subcall function 004014E4: GetModuleHandleW.KERNEL32(?,?,0040224B,KERNEL32.DLL,?,00402297,?,00401852,00000003,?,?,?,?,?,?,004011F9), ref: 004014F9

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040232E
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0040233E
__lock.LIBCMT ref: 00402360
InterlockedIncrement.KERNEL32(0040A4D8), ref: 0040236D
__lock.LIBCMT ref: 00402381
___addlocaleref.LIBCMT ref: 0040239F

Strings

KERNEL32.DLL, xrefs: 004022F4, 004022F9, 00402304
EncodePointer, xrefs: 00402322
DecodePointer, xrefs: 00402336

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 3c90370a69a19e0d812ac32652c67b0111b7b673ee287a6a27834a4c9d3cc929
Instruction ID: 47c7b94658c3180f8af90285d2e5f91ae2de99e56f50fb2c65ace596bdd254a9
Opcode Fuzzy Hash: 3c90370a69a19e0d812ac32652c67b0111b7b673ee287a6a27834a4c9d3cc929
Instruction Fuzzy Hash: 3E116071800B01AAD721AF769A49B5ABBE4AF44314F20453FE499B72E1CBBC99408F1D

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 004041AC

Part of subcall function 00402448: __getptd_noexit.LIBCMT ref: 0040244B
Part of subcall function 00402448: __amsg_exit.LIBCMT ref: 00402458

__amsg_exit.LIBCMT ref: 004041CC
__lock.LIBCMT ref: 004041DC
InterlockedDecrement.KERNEL32(?), ref: 004041F9
InterlockedIncrement.KERNEL32(006E2CE8), ref: 00404224

Strings

,n, xrefs: 00404212, 0040421A

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: ,n
API String ID: 4271482742-1997189997
Opcode ID: c848c12c1530f626c4a03d736edc537a0cacf718be0be435a3da71b85a1f754b
Instruction ID: 69f05fad060556697c18b334e2f7b8fe67bc1670ff3b9087f47013a2c5b4637d
Opcode Fuzzy Hash: c848c12c1530f626c4a03d736edc537a0cacf718be0be435a3da71b85a1f754b
Instruction Fuzzy Hash: 4701CEB1A01721ABC611AF669A0974A7360AB80754F05007FFA00B72D1CB7C6991DBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004036EE Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040370C

Part of subcall function 00402BA0: __mtinitlocknum.LIBCMT ref: 00402BB6
Part of subcall function 00402BA0: __amsg_exit.LIBCMT ref: 00402BC2
Part of subcall function 00402BA0: EnterCriticalSection.KERNEL32(?,?,?,00405700,00000004,004095C8,0000000C,00403846,?,?,00000000,00000000,00000000,?,004023FA,00000001), ref: 00402BCA

___sbh_find_block.LIBCMT ref: 00403717
___sbh_free_block.LIBCMT ref: 00403726
HeapFree.KERNEL32(00000000,?,00409508,0000000C,00402B81,00000000,00409468,0000000C,00402BBB,?,?,?,00405700,00000004,004095C8,0000000C), ref: 00403756
GetLastError.KERNEL32(?,00405700,00000004,004095C8,0000000C,00403846,?,?,00000000,00000000,00000000,?,004023FA,00000001,00000214), ref: 00403767

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 8a27e62127ae4da16c70517f6f22f09c9530f4d66b5ad0cff3ba26a25102a682
Instruction ID: abf45a1ca9252dda1e0529fa6b3bb61747b9f0bac299b095bff4a07165a28aad
Opcode Fuzzy Hash: 8a27e62127ae4da16c70517f6f22f09c9530f4d66b5ad0cff3ba26a25102a682
Instruction Fuzzy Hash: 8A01A2F1804315EADB206F729D0AF5E7A68AF00766F24803FF440B71D1DB7C9A408A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00403F04 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00403F10

Part of subcall function 00402448: __getptd_noexit.LIBCMT ref: 0040244B
Part of subcall function 00402448: __amsg_exit.LIBCMT ref: 00402458

__getptd.LIBCMT ref: 00403F27
__amsg_exit.LIBCMT ref: 00403F35
__lock.LIBCMT ref: 00403F45

Memory Dump Source

Source File: 00000000.00000002.1628254570.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1628242939.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628305102.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628318835.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1628338411.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RevoUPort.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 7a6a530fe00332c8c656de10a6d8be7700ef1b4a328f8d080274b5d211581fa4
Instruction ID: 4871c6495fd446f4ff109469d79082d8d99c2824b1316f52a7fd2c417fac1005
Opcode Fuzzy Hash: 7a6a530fe00332c8c656de10a6d8be7700ef1b4a328f8d080274b5d211581fa4
Instruction Fuzzy Hash: 49F06D329107119BD721FF768A0A74D76B46B4072AF54457FA001BB2D2CBBC9A018B6E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RevoUPort.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: RevoUPort.exePID: 6408, Parent PID: 2580

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Registry Activities

Key Opened

Key Value Queried

Windows Analysis Report
RevoUPort.exe