Edit tour

Windows Analysis Report
NezbdhNgwG.exe

Overview

General Information

Sample Name:	NezbdhNgwG.exe
Original Sample Name:	a650ffe73f9994ad3844fedd49ba10f3.exe
Analysis ID:	1347939
MD5:	a650ffe73f9994ad3844fedd49ba10f3
SHA1:	958e2c74bdf856eeb7ca4dbbf9ab746d1c85e712
SHA256:	1064502587b0806ba7b4c026520f1774e8b9446c68e511cf3edf1850132ae699
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Njrat

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Uses netsh to modify the Windows network and firewall settings

Drops PE files to the startup folder

Protects its processes via BreakOnTermination flag

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

.NET source code contains potential unpacker

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Creates autostart registry keys with suspicious names

Modifies the windows firewall

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

May infect USB drives

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality to call native functions

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a start menu entry (Start Menu\Programs\Startup)

Classification

Process Tree

System is w10x64

NezbdhNgwG.exe (PID: 6952 cmdline: C:\Users\user\Desktop\NezbdhNgwG.exe MD5: A650FFE73F9994AD3844FEDD49BA10F3)

netsh.exe (PID: 6584 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NezbdhNgwG.exe (PID: 6232 cmdline: "C:\Users\user\Desktop\NezbdhNgwG.exe" .. MD5: A650FFE73F9994AD3844FEDD49BA10F3)

NezbdhNgwG.exe (PID: 5228 cmdline: "C:\Users\user\Desktop\NezbdhNgwG.exe" .. MD5: A650FFE73F9994AD3844FEDD49BA10F3)

NezbdhNgwG.exe (PID: 3748 cmdline: "C:\Users\user\Desktop\NezbdhNgwG.exe" .. MD5: A650FFE73F9994AD3844FEDD49BA10F3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "System.Security.Permissions.IUnrestrictedPermission", "Port": "11531", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
NezbdhNgwG.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
NezbdhNgwG.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
NezbdhNgwG.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
NezbdhNgwG.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7cfa:$a3: Download ERROR 0x7fec:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ee2:$a1: netsh firewall add allowedprogram 0x80dc:$b1: [TAP] 0x8082:$b2: & exit 0x804e:$c1: md.exe /k ping 0 & del
00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: NezbdhNgwG.exe PID: 6952	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.NezbdhNgwG.exe.20000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.NezbdhNgwG.exe.20000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
0.0.NezbdhNgwG.exe.20000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
0.0.NezbdhNgwG.exe.20000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Snort Signatures

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849736115312814856 11/26/23-15:17:14.013168
SID:	2814856
Source Port:	49736
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649738115312825564 11/26/23-15:19:41.517209
SID:	2825564
Source Port:	49738
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649729115312033132 11/26/23-15:16:09.891923
SID:	2033132
Source Port:	49729
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649738115312033132 11/26/23-15:19:21.604980
SID:	2033132
Source Port:	49738
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649729115312825564 11/26/23-15:17:09.256355
SID:	2825564
Source Port:	49729
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649738115312825563 11/26/23-15:19:21.784381
SID:	2825563
Source Port:	49738
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949737115312814856 11/26/23-15:18:17.782445
SID:	2814856
Source Port:	49737
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849736115312814860 11/26/23-15:18:09.757619
SID:	2814860
Source Port:	49736
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649729115312814860 11/26/23-15:17:09.256355
SID:	2814860
Source Port:	49729
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649738115312814856 11/26/23-15:19:21.784381
SID:	2814856
Source Port:	49738
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949737115312033132 11/26/23-15:18:17.603963
SID:	2033132
Source Port:	49737
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949737115312814860 11/26/23-15:18:42.758182
SID:	2814860
Source Port:	49737
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649729115312814856 11/26/23-15:16:10.074575
SID:	2814856
Source Port:	49729
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649738115312814860 11/26/23-15:19:41.517209
SID:	2814860
Source Port:	49738
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849736115312033132 11/26/23-15:17:13.832319
SID:	2033132
Source Port:	49736
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849736115312825564 11/26/23-15:18:09.757619
SID:	2825564
Source Port:	49736
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949737115312825563 11/26/23-15:18:17.782445
SID:	2825563
Source Port:	49737
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 18.192.93.86

Timestamp:	192.168.2.418.192.93.8649729115312825563 11/26/23-15:16:10.074575
SID:	2825563
Source Port:	49729
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949737115312825564 11/26/23-15:18:42.758182
SID:	2825564
Source Port:	49737
Destination Port:	11531
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Njrat {"Host": "System.Security.Permissions.IUnrestrictedPermission", "Port": "11531", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Multi AV Scanner detection for submitted file

Source: NezbdhNgwG.exe	ReversingLabs: Detection: 86%
Source: NezbdhNgwG.exe	Virustotal: Detection: 82%			Perma Link

Yara detected Njrat

Source: Yara match	File source: NezbdhNgwG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NezbdhNgwG.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED

Antivirus / Scanner detection for submitted sample

Source: NezbdhNgwG.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: 2.tcp.eu.ngrok.io

Virustotal: Detection: 15%

Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Avira: detection malicious, Label: TR/ATRAPS.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	Virustotal: Detection: 82%			Perma Link

Machine Learning detection for sample

Source: NezbdhNgwG.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Joe Sandbox ML: detected

Source: NezbdhNgwG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: NezbdhNgwG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: NezbdhNgwG.exe, 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: NezbdhNgwG.exe, 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: NezbdhNgwG.exe	Binary or memory string: autorun.inf
Source: NezbdhNgwG.exe	Binary or memory string: [autorun]
Source: 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr	Binary or memory string: autorun.inf
Source: 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr	Binary or memory string: [autorun]

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49729 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49729 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49729 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49729 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49736 -> 3.126.37.18:11531
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49736 -> 3.126.37.18:11531
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49736 -> 3.126.37.18:11531
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49736 -> 3.126.37.18:11531
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49737 -> 18.156.13.209:11531
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49737 -> 18.156.13.209:11531
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49737 -> 18.156.13.209:11531
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49737 -> 18.156.13.209:11531
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49737 -> 18.156.13.209:11531
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49738 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49738 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49738 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49738 -> 18.192.93.86:11531
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49738 -> 18.192.93.86:11531

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: System.Security.Permissions.IUnrestrictedPermission

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View	IP Address: 18.192.93.86 18.192.93.86
Source: Joe Sandbox View	IP Address: 3.126.37.18 3.126.37.18
Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209

Source: global traffic	TCP traffic: 192.168.2.4:49729 -> 18.192.93.86:11531
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 3.126.37.18:11531
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 18.156.13.209:11531

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127
Source: NezbdhNgwG.exe, 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

Source: unknown

DNS traffic detected: queries for: 2.tcp.eu.ngrok.io

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: NezbdhNgwG.exe, kl.cs	.Net Code: VKCodeToUnicode
Source: 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: NezbdhNgwG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NezbdhNgwG.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: NezbdhNgwG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: NezbdhNgwG.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Code function: 0_2_00A3170F

0_2_00A3170F

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060BBEA NtSetInformationProcess,	0_2_0060BBEA
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060BECA NtQuerySystemInformation,	0_2_0060BECA
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060BBC8 NtSetInformationProcess,	0_2_0060BBC8
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060BE8F NtQuerySystemInformation,	0_2_0060BE8F

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process Stats: CPU usage > 49%

Source: NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000061E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs NezbdhNgwG.exe

Source: NezbdhNgwG.exe	ReversingLabs: Detection: 86%
Source: NezbdhNgwG.exe	Virustotal: Detection: 82%

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File read: C:\Users\user\Desktop\NezbdhNgwG.exe

Jump to behavior

Source: NezbdhNgwG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NezbdhNgwG.exe C:\Users\user\Desktop\NezbdhNgwG.exe
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\NezbdhNgwG.exe "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\NezbdhNgwG.exe "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\NezbdhNgwG.exe "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060B89A AdjustTokenPrivileges,		0_2_0060B89A
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Code function: 0_2_0060B863 AdjustTokenPrivileges,		0_2_0060B863

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@7/4@4/3

Source: NezbdhNgwG.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_03
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Mutant created: \Sessions\1\BaseNamedObjects\8c3a19ded61c2fe03bf66a3900261406

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: NezbdhNgwG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NezbdhNgwG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: NezbdhNgwG.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Jump to dropped file

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe			Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe TID: 6924	Thread sleep time: -650000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe TID: 6924	Thread sleep time: -4559000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe TID: 3488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe TID: 2032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe TID: 5252	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Window / User API: threadDelayed 3212	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Window / User API: threadDelayed 650	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Window / User API: threadDelayed 4559	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Window / User API: foregroundWindowGot 425	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Window / User API: foregroundWindowGot 1274	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000068C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: netsh.exe, 00000001.00000003.1710593915.0000000000742000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: NezbdhNgwG.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: NezbdhNgwG.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: NezbdhNgwG.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000029CD000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000029B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000029CD000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.
Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000029CD000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000029B7000.00000004.00000800.00020000.00000000.sdmp, NezbdhNgwG.exe, 00000000.00000002.4081955950.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NezbdhNgwG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE

Modifies the windows firewall

Source: C:\Users\user\Desktop\NezbdhNgwG.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: NezbdhNgwG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NezbdhNgwG.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: NezbdhNgwG.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NezbdhNgwG.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NezbdhNgwG.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Replication Through Removable Media	1 Native API	221 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	1 Input Capture	11 Security Software Discovery	1 Replication Through Removable Media	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	21 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	221 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	11 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NezbdhNgwG.exe	86%	ReversingLabs	ByteCode-MSIL.Trojan.NjRAT
NezbdhNgwG.exe	83%	Virustotal		Browse
NezbdhNgwG.exe	100%	Avira	TR/ATRAPS.Gen
NezbdhNgwG.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	86%	ReversingLabs	ByteCode-MSIL.Trojan.NjRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe	83%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
2.tcp.eu.ngrok.io	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe
System.Security.Permissions.IUnrestrictedPermission	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	18.192.93.86	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
System.Security.Permissions.IUnrestrictedPermission	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	NezbdhNgwG.exe, 8c3a19ded61c2fe03bf66a3900261406.exe.0.dr	false		high
http://go.microsoft.LinkId=42127	NezbdhNgwG.exe, 00000000.00000002.4081376804.000000000064F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.192.93.86	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
3.126.37.18	unknown	United States	16509	AMAZON-02US	true
18.156.13.209	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1347939
Start date and time:	2023-11-26 15:15:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	NezbdhNgwG.exe renamed because original name is a hash value
Original Sample Name:	a650ffe73f9994ad3844fedd49ba10f3.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@7/4@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 143 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:16:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406 "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
14:16:14	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406 "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
14:16:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8c3a19ded61c2fe03bf66a3900261406 "C:\Users\user\Desktop\NezbdhNgwG.exe" ..
14:16:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe
15:16:40	API Interceptor	78095x Sleep call for process: NezbdhNgwG.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.192.93.86	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.192.93.86	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
3.126.37.18	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse
	gEuhLHV0.posh.ps1	Get hash	malicious	Metasploit	Browse
	MibKbjH4.posh.ps1	Get hash	malicious	Unknown	Browse
	kXghM8bJcm.exe	Get hash	malicious	Njrat	Browse
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse
	p0zYXkMETE.exe	Get hash	malicious	Njrat	Browse
	i9z1c1OtFb.exe	Get hash	malicious	Njrat	Browse
	7XyFhq6BDj.exe	Get hash	malicious	Njrat	Browse
	JYGc3o49WE.exe	Get hash	malicious	Njrat	Browse
	J6VIiRgq3w.exe	Get hash	malicious	Njrat	Browse
	cTUu5Po5Hy.exe	Get hash	malicious	Njrat	Browse
	KcWQQO3nZP.exe	Get hash	malicious	Njrat	Browse
	zep8vTa4sg.exe	Get hash	malicious	Njrat	Browse
	u1LwUkKDIF.exe	Get hash	malicious	Njrat	Browse
	QBEgLAO40T.exe	Get hash	malicious	Njrat	Browse
	yPGBUzqVE3.exe	Get hash	malicious	Njrat	Browse
	LMva1J8Xkv.exe	Get hash	malicious	Njrat	Browse
	XlNjZS4E8x.exe	Get hash	malicious	Njrat	Browse
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	1UGdjTlX5v.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	kXghM8bJcm.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	QzzmZiGinp.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	p0zYXkMETE.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	i9z1c1OtFb.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	aF73k2XwGj.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	7XyFhq6BDj.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	JYGc3o49WE.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	J6VIiRgq3w.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	cTUu5Po5Hy.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	7JdbeSrZ6s.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	KcWQQO3nZP.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	zep8vTa4sg.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	umyExrpkSF.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	u1LwUkKDIF.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	QBEgLAO40T.exe	Get hash	malicious	Njrat	Browse	3.126.37.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Acknowledge_Letter.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.248.169.48
	Summon_From_SARS.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.248.169.48
	klWGq3yDcQ.exe	Get hash	malicious	Unknown	Browse	3.111.240.6
	x4vHvrR5KfYz.exe	Get hash	malicious	Remcos	Browse	3.132.233.132
	https://www.ukotayc.online/login	Get hash	malicious	Unknown	Browse	52.196.133.58
	https://www.clauxtw.space/login	Get hash	malicious	Unknown	Browse	18.180.185.133
	https://www.kmb.net.cn/login	Get hash	malicious	Unknown	Browse	3.141.130.14
	https://www.ydjlseub.asia/login	Get hash	malicious	Unknown	Browse	52.196.133.58
	https://netflix.cnetms.info/	Get hash	malicious	Unknown	Browse	3.162.125.65
	Clylm.exe	Get hash	malicious	Clipboard Hijacker	Browse	45.112.123.225
	C4PROloader.exe	Get hash	malicious	Clipboard Hijacker	Browse	45.112.123.225
	imaginebeingarm7.elf	Get hash	malicious	Mirai, Moobot	Browse	54.185.230.120
	imaginebeingx86.elf	Get hash	malicious	Mirai, Moobot	Browse	52.13.83.141
	YEcmxSymXx.elf	Get hash	malicious	Mirai	Browse	13.125.237.176
	H2OePICEV5.elf	Get hash	malicious	Mirai	Browse	44.248.108.40
	RMPDrCqc6N.elf	Get hash	malicious	Mirai	Browse	71.152.84.55
	syms.arm.elf	Get hash	malicious	Mirai	Browse	65.1.108.0
	aMGTc878Pm.exe	Get hash	malicious	FormBook	Browse	76.76.21.22
	8MlaKaB5fV.exe	Get hash	malicious	FormBook	Browse	76.76.21.61
	https://helpdesk-center-id-1576761.vercel.app/#/	Get hash	malicious	Unknown	Browse	76.76.21.164
AMAZON-02US	Acknowledge_Letter.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.248.169.48
	Summon_From_SARS.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.248.169.48
	klWGq3yDcQ.exe	Get hash	malicious	Unknown	Browse	3.111.240.6
	x4vHvrR5KfYz.exe	Get hash	malicious	Remcos	Browse	3.132.233.132
	https://www.ukotayc.online/login	Get hash	malicious	Unknown	Browse	52.196.133.58
	https://www.clauxtw.space/login	Get hash	malicious	Unknown	Browse	18.180.185.133
	https://www.kmb.net.cn/login	Get hash	malicious	Unknown	Browse	3.141.130.14
	https://www.ydjlseub.asia/login	Get hash	malicious	Unknown	Browse	52.196.133.58
	https://netflix.cnetms.info/	Get hash	malicious	Unknown	Browse	3.162.125.65
	Clylm.exe	Get hash	malicious	Clipboard Hijacker	Browse	45.112.123.225
	C4PROloader.exe	Get hash	malicious	Clipboard Hijacker	Browse	45.112.123.225
	imaginebeingarm7.elf	Get hash	malicious	Mirai, Moobot	Browse	54.185.230.120
	imaginebeingx86.elf	Get hash	malicious	Mirai, Moobot	Browse	52.13.83.141
	YEcmxSymXx.elf	Get hash	malicious	Mirai	Browse	13.125.237.176
	H2OePICEV5.elf	Get hash	malicious	Mirai	Browse	44.248.108.40
	RMPDrCqc6N.elf	Get hash	malicious	Mirai	Browse	71.152.84.55
	syms.arm.elf	Get hash	malicious	Mirai	Browse	65.1.108.0
	aMGTc878Pm.exe	Get hash	malicious	FormBook	Browse	76.76.21.22
	8MlaKaB5fV.exe	Get hash	malicious	FormBook	Browse	76.76.21.61
	https://helpdesk-center-id-1576761.vercel.app/#/	Get hash	malicious	Unknown	Browse	76.76.21.164

Process:	C:\Users\user\Desktop\NezbdhNgwG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

Download File

Process:	C:\Users\user\Desktop\NezbdhNgwG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.525477592058185
Encrypted:	false
SSDEEP:	384:OOtvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX6:7t7TZ38fvCv3E1c1rM+rMRa8Numzt
MD5:	A650FFE73F9994AD3844FEDD49BA10F3
SHA1:	958E2C74BDF856EEB7CA4DBBF9AB746D1C85E712
SHA-256:	1064502587B0806BA7B4C026520F1774E8B9446C68E511CF3EDF1850132AE699
SHA-512:	A303032B3E83C43D0FDCC043C2E804061CEB04F60068E19367E27F903455028740A034FDC336A2FA52165022997FF60795CAA71555A41577C89834B9EE4B3F97
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86% Antivirus: Virustotal, Detection: 83%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G[e................................. ........@.. ....................................@.................................l...O.................................................................................... ............... ..H............text....... ...................... ..`.reloc..............................@..B................................................................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\NezbdhNgwG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.525477592058185
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	NezbdhNgwG.exe
File size:	36'864 bytes
MD5:	a650ffe73f9994ad3844fedd49ba10f3
SHA1:	958e2c74bdf856eeb7ca4dbbf9ab746d1c85e712
SHA256:	1064502587b0806ba7b4c026520f1774e8b9446c68e511cf3edf1850132ae699
SHA512:	a303032b3e83c43d0fdcc043c2e804061ceb04f60068e19367e27f903455028740a034fdc336a2fa52165022997ff60795caa71555a41577c89834b9ee4b3f97
SSDEEP:	384:OOtvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX6:7t7TZ38fvCv3E1c1rM+rMRa8Numzt
TLSH:	C8F22A4D7BE08168D9FD067B05B2E4130776E04B5E23DD0D8EF2A4EA37636D18B54EA2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G[e................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40abbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x655B47B0 [Mon Nov 20 11:49:04 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab6c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bc4	0x8c00	False	0.4636997767857143	data	5.608731270610776	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.43.126.37.1849736115312814856 11/26/23-15:17:14.013168	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49736	11531	192.168.2.4	3.126.37.18
192.168.2.418.192.93.8649738115312825564 11/26/23-15:19:41.517209	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49738	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649729115312033132 11/26/23-15:16:09.891923	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649738115312033132 11/26/23-15:19:21.604980	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649729115312825564 11/26/23-15:17:09.256355	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49729	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649738115312825563 11/26/23-15:19:21.784381	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49738	11531	192.168.2.4	18.192.93.86
192.168.2.418.156.13.20949737115312814856 11/26/23-15:18:17.782445	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49737	11531	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849736115312814860 11/26/23-15:18:09.757619	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49736	11531	192.168.2.4	3.126.37.18
192.168.2.418.192.93.8649729115312814860 11/26/23-15:17:09.256355	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49729	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649738115312814856 11/26/23-15:19:21.784381	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49738	11531	192.168.2.4	18.192.93.86
192.168.2.418.156.13.20949737115312033132 11/26/23-15:18:17.603963	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49737	11531	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949737115312814860 11/26/23-15:18:42.758182	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49737	11531	192.168.2.4	18.156.13.209
192.168.2.418.192.93.8649729115312814856 11/26/23-15:16:10.074575	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49729	11531	192.168.2.4	18.192.93.86
192.168.2.418.192.93.8649738115312814860 11/26/23-15:19:41.517209	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49738	11531	192.168.2.4	18.192.93.86
192.168.2.43.126.37.1849736115312033132 11/26/23-15:17:13.832319	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	11531	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849736115312825564 11/26/23-15:18:09.757619	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49736	11531	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949737115312825563 11/26/23-15:18:17.782445	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49737	11531	192.168.2.4	18.156.13.209
192.168.2.418.192.93.8649729115312825563 11/26/23-15:16:10.074575	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49729	11531	192.168.2.4	18.192.93.86
192.168.2.418.156.13.20949737115312825564 11/26/23-15:18:42.758182	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49737	11531	192.168.2.4	18.156.13.209

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2023 15:16:09.431395054 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:09.613898039 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:09.614084959 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:09.891922951 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:10.074409962 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:10.074574947 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:10.256975889 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:15.083389044 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:15.265846968 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:23.741148949 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:23.923768997 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:39.092544079 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:39.092727900 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:41.709747076 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:16:41.892309904 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:57.016311884 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:16:57.016413927 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:17:07.959525108 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:17:08.141911030 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:17:09.256355047 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:17:09.438638926 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:17:11.288283110 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:17:11.288377047 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:17:13.511118889 CET	49729	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:17:13.646476984 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:13.693680048 CET	11531	49729	18.192.93.86	192.168.2.4
Nov 26, 2023 15:17:13.827280045 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:13.827383041 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:13.832319021 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:14.013078928 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:14.013168097 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:14.193963051 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:14.912760973 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:15.093735933 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:15.093784094 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:15.274584055 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:16.178138018 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:16.360241890 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:16.360415936 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:16.541205883 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:16.541291952 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:16.731105089 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:16.731301069 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:16.912110090 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:16.912249088 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.093115091 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.093211889 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.274190903 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.274279118 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.456373930 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.456563950 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.637754917 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.637888908 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.818708897 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.818789959 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:17.999633074 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:17.999723911 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:18.180509090 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:18.180625916 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:18.361455917 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:18.361572981 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:18.542367935 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:18.542448044 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:18.723185062 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:18.723284960 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:18.905602932 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:18.905719995 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.086555004 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.086636066 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.267574072 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.267708063 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.448591948 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.448720932 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.631359100 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.631494999 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.812367916 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.812484026 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:19.993233919 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:19.993338108 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:20.176121950 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:20.176201105 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:20.357003927 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:20.357183933 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:20.541517973 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:20.541636944 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:20.722486019 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:20.722621918 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:20.903361082 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:20.903435946 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.084799051 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.084894896 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.265791893 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.265886068 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.446891069 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.446953058 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.627641916 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.627721071 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.809509993 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.809664965 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:21.990515947 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:21.990611076 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:22.171487093 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:22.171616077 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:22.352520943 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:22.352648973 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:22.533507109 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:22.533708096 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:22.714728117 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:22.714838982 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:22.895659924 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:22.895736933 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.076895952 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.077022076 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.258374929 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.258526087 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.439542055 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.439721107 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.620600939 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.620687008 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.801623106 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.801693916 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:23.982521057 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:23.982631922 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:24.163747072 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:24.163856030 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:24.344638109 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:24.344705105 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:24.527699947 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:24.527820110 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:24.708728075 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:24.708949089 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:24.889877081 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:24.889972925 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.070867062 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.070955992 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.251899004 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.252110958 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.433146954 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.433233023 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.614097118 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.614195108 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.795162916 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.795258045 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:25.976160049 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:25.976272106 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:26.157118082 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:26.157301903 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:26.338130951 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:26.338224888 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:26.519217968 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:26.519280910 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:26.700170994 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:26.700249910 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:26.881000996 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:26.881072998 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:27.061888933 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:27.061961889 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:27.243763924 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:27.243838072 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:27.428391933 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:27.428487062 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:27.609548092 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:27.609725952 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:27.790766954 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:29.684566975 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:29.865417957 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:29.865689039 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.049297094 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.049613953 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.230443001 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.230523109 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.411613941 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.411756039 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.592603922 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.592812061 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.774288893 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.774349928 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:30.956262112 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:30.956358910 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:31.139028072 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:31.139128923 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:31.319935083 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:31.320152044 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:31.501025915 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:31.501205921 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:31.681994915 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:31.682178974 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:31.862992048 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:31.863246918 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.044050932 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.044274092 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.228190899 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.228288889 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.409133911 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.409328938 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.590173960 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.590257883 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.771114111 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.771321058 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:32.952178001 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:32.952258110 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:33.136365891 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:33.136475086 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:33.317339897 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:33.317464113 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:33.498316050 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:33.498522043 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:17:33.679425001 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:48.745446920 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:17:48.745522976 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:18:03.929421902 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:18:03.932360888 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:18:09.757618904 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:18:09.938425064 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:18:15.286236048 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:18:15.286333084 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:18:17.287522078 CET	49736	11531	192.168.2.4	3.126.37.18
Nov 26, 2023 15:18:17.423034906 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:17.468398094 CET	11531	49736	3.126.37.18	192.168.2.4
Nov 26, 2023 15:18:17.601541996 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:17.601739883 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:17.603962898 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:17.782394886 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:17.782444954 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:17.960891962 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:20.521955967 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:20.700448036 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:34.616025925 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:34.794645071 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:42.758182049 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:18:42.936748981 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:58.072940111 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:18:58.073147058 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:19:13.253568888 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:19:13.253739119 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:19:19.284349918 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:19:19.284482956 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:19:21.287312031 CET	49737	11531	192.168.2.4	18.156.13.209
Nov 26, 2023 15:19:21.423450947 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:21.466115952 CET	11531	49737	18.156.13.209	192.168.2.4
Nov 26, 2023 15:19:21.602653980 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:21.602735043 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:21.604979992 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:21.784280062 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:21.784380913 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:21.963493109 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:24.662637949 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:24.841862917 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:32.054653883 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:32.233968019 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:33.476535082 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:33.655824900 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:39.420361996 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:39.599628925 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:39.617821932 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:39.798747063 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:40.799016953 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:40.978250027 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:40.978458881 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:41.158391953 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:41.158543110 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:41.337805033 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:41.337951899 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:41.517117023 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:41.517209053 CET	49738	11531	192.168.2.4	18.192.93.86
Nov 26, 2023 15:19:41.696475029 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:56.724064112 CET	11531	49738	18.192.93.86	192.168.2.4
Nov 26, 2023 15:19:56.724136114 CET	49738	11531	192.168.2.4	18.192.93.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2023 15:16:09.294425011 CET	54386	53	192.168.2.4	1.1.1.1
Nov 26, 2023 15:16:09.428083897 CET	53	54386	1.1.1.1	192.168.2.4
Nov 26, 2023 15:17:13.512598038 CET	56512	53	192.168.2.4	1.1.1.1
Nov 26, 2023 15:17:13.645319939 CET	53	56512	1.1.1.1	192.168.2.4
Nov 26, 2023 15:18:17.289370060 CET	56393	53	192.168.2.4	1.1.1.1
Nov 26, 2023 15:18:17.421515942 CET	53	56393	1.1.1.1	192.168.2.4
Nov 26, 2023 15:19:21.288693905 CET	51800	53	192.168.2.4	1.1.1.1
Nov 26, 2023 15:19:21.422415972 CET	53	51800	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2023 15:16:09.294425011 CET	192.168.2.4	1.1.1.1	0x1413	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:17:13.512598038 CET	192.168.2.4	1.1.1.1	0x77c0	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:18:17.289370060 CET	192.168.2.4	1.1.1.1	0xe20d	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:19:21.288693905 CET	192.168.2.4	1.1.1.1	0x8067	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 26, 2023 15:16:09.428083897 CET	1.1.1.1	192.168.2.4	0x1413	No error (0)	2.tcp.eu.ngrok.io	18.192.93.86	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:17:13.645319939 CET	1.1.1.1	192.168.2.4	0x77c0	No error (0)	2.tcp.eu.ngrok.io	3.126.37.18	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:18:17.421515942 CET	1.1.1.1	192.168.2.4	0xe20d	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Nov 26, 2023 15:19:21.422415972 CET	1.1.1.1	192.168.2.4	0x8067	No error (0)	2.tcp.eu.ngrok.io	18.192.93.86	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:15:59
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\NezbdhNgwG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NezbdhNgwG.exe
Imagebase:	0x20000
File size:	36'864 bytes
MD5 hash:	A650FFE73F9994AD3844FEDD49BA10F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1642177967.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4081955950.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:16:05
Start date:	26/11/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\NezbdhNgwG.exe" "NezbdhNgwG.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:16:05
Start date:	26/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:16:14
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\NezbdhNgwG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Imagebase:	0x330000
File size:	36'864 bytes
MD5 hash:	A650FFE73F9994AD3844FEDD49BA10F3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:16:22
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\NezbdhNgwG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Imagebase:	0x9f0000
File size:	36'864 bytes
MD5 hash:	A650FFE73F9994AD3844FEDD49BA10F3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:16:30
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\NezbdhNgwG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NezbdhNgwG.exe" ..
Imagebase:	0x1c0000
File size:	36'864 bytes
MD5 hash:	A650FFE73F9994AD3844FEDD49BA10F3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	13.1%
Total number of Nodes:	175
Total number of Limit Nodes:	7

Executed Functions

Function 0060B863 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0060B8E3

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 729e8e35b5392b9e5f46e9c69dc9c990b9def7551a5a6369a65d855d142f8e31
Instruction ID: e93a8ffba069c0981ad0e081a5eba6f157fe0a0d5fd86f5cadd28650b86ebfde
Opcode Fuzzy Hash: 729e8e35b5392b9e5f46e9c69dc9c990b9def7551a5a6369a65d855d142f8e31
Instruction Fuzzy Hash: 9E21B1755097809FDB228F25DC40B92BFB4EF16310F08849AE9848B6A3D2709908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060BE8F Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0060BF05

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 005e137009ecfc2c4a77ada18dacc7e29bf15279f97c9516f85a66afde317cbb
Instruction ID: 3c359f932ad71176328de2905c6a795550322560f063fe275235b324788d06e7
Opcode Fuzzy Hash: 005e137009ecfc2c4a77ada18dacc7e29bf15279f97c9516f85a66afde317cbb
Instruction Fuzzy Hash: 1421DEB54097C09FDB238B20DC41A52FFB0EF17314F0980CBE9848B1A3D265A90DDB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060B89A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0060B8E3

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 769f16ef42afa41d902ac3f844881a3ee2d5e73b8d099ab7b3111810904de358
Instruction ID: d86f97f508812bc48b3d8783795a17ded90c76470cc8551486f9bac946a09b42
Opcode Fuzzy Hash: 769f16ef42afa41d902ac3f844881a3ee2d5e73b8d099ab7b3111810904de358
Instruction Fuzzy Hash: 8F1182726007409FEB20CF55D984B66FBE8EF05320F08C86ADE458B661D375E818DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0060BBC8 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 0060BC25

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: c162e9a90655596e5df6ecf3a1786eabfd3a161d51917b589798107ddcfcd5d9
Instruction ID: a3d513a5dc1b772a330c367c40cab5a1d41f2581df5f8da38376b06252b7e710
Opcode Fuzzy Hash: c162e9a90655596e5df6ecf3a1786eabfd3a161d51917b589798107ddcfcd5d9
Instruction Fuzzy Hash: 7B11CE71549780AFDB228F11DC44E62FFB4EF16324F09C49EEE844B662C275A918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060BBEA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 0060BC25

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 0fdc7180e7b2fab19ad77a4287982a7ceca401d9063e2513c8024d9d7bbbf743
Instruction ID: 817fd653cd927eea335f7aab0004c612527529d198f9c1de6d41308dc3cfb722
Opcode Fuzzy Hash: 0fdc7180e7b2fab19ad77a4287982a7ceca401d9063e2513c8024d9d7bbbf743
Instruction Fuzzy Hash: A301AD715406409FEB208F05D984B62FBE0EF08724F08C4AADE490B7A2C775E458DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0060BECA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0060BF05

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 0fdc7180e7b2fab19ad77a4287982a7ceca401d9063e2513c8024d9d7bbbf743
Instruction ID: 03d6ff5109933f3a4744e5f3984eb5dd5caf55c455c66c0ec8d8cbafdfb5f2e4
Opcode Fuzzy Hash: 0fdc7180e7b2fab19ad77a4287982a7ceca401d9063e2513c8024d9d7bbbf743
Instruction Fuzzy Hash: BA01AD715406409FDB208F05ED84B62FBE0EF08724F08C4AADE490B792D375E818DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3170F Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081833983.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9f39999ab26ab773f549dacc9ea2f448b2ae822db3892754bb8d05e6d30b59
Instruction ID: 182156102e87495d0a7e16b0e911bf8ca1dc1966a455e05590b64409490f656e
Opcode Fuzzy Hash: 2e9f39999ab26ab773f549dacc9ea2f448b2ae822db3892754bb8d05e6d30b59
Instruction Fuzzy Hash: 67327B307102018BDB18EB79D5617BE77E6AF88308F14842AE446DB799DF38DC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A30F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00A30FB7

Memory Dump Source

Source File: 00000000.00000002.4081833983.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_NezbdhNgwG.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ed2487b9d598487b1a129f966948d7b872ed06fd0551c5184404b4205bf961ce
Instruction ID: fc003c43184c0136776c15300493cf56edb8505db480b579541fbd1cb74762d6
Opcode Fuzzy Hash: ed2487b9d598487b1a129f966948d7b872ed06fd0551c5184404b4205bf961ce
Instruction Fuzzy Hash: 0D418D317102018FCB14DF78D8946AEB7A6AF84204F148479E809DB39ADF39CD86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A30F80 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00A30FB7

Memory Dump Source

Source File: 00000000.00000002.4081833983.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_NezbdhNgwG.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7c6315d2dbbdffe9624b6d7628e9c32d7e3411a15946809b9055d8ea46a9cf6f
Instruction ID: 2b75932573bf15d80f22c2c7478752fd9607051d14888eddaf4d1be0c5744e5a
Opcode Fuzzy Hash: 7c6315d2dbbdffe9624b6d7628e9c32d7e3411a15946809b9055d8ea46a9cf6f
Instruction Fuzzy Hash: 304162357102018FCB14DF34C994AAA77E6AF45314F188479E805DF39AEB39DD86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1C32 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 00BC1D16

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: b7291da6b801768a785cdbcddc123975f2e1e5e9ccae04df93e7347913342554
Instruction ID: be6da567c2a3887278f40a8314ca13e9e6e5a1594a216210bbcb056d63bccc4a
Opcode Fuzzy Hash: b7291da6b801768a785cdbcddc123975f2e1e5e9ccae04df93e7347913342554
Instruction Fuzzy Hash: EA415C6150E3C16FD3038B358C61AA2BFB4AF47210F1E85CBD8C4CF5A3D6246959C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2C1A Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 00BC2CE1

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0f563ae741bbffee00e9abfc645e23ebd5faf467cf8169e46cdd5bf9b55a86b7
Instruction ID: c152077f7004067e9296a15f8aefe1dfe0e52900a27e4a162e7d520603b51413
Opcode Fuzzy Hash: 0f563ae741bbffee00e9abfc645e23ebd5faf467cf8169e46cdd5bf9b55a86b7
Instruction Fuzzy Hash: 06316F72504744AFE7218F65CC44FA7BBFCEF19314F08859AE9858B662D324E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0D77 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 00BC0E3E

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 65e4363bce503cd7ebb9652410f51d4fa2241264d04e74840e3747cf862d7ae4
Instruction ID: 36f96eb9561a147ba42321273e8f6dba79c678c0889d710c32cd571da9187bc8
Opcode Fuzzy Hash: 65e4363bce503cd7ebb9652410f51d4fa2241264d04e74840e3747cf862d7ae4
Instruction Fuzzy Hash: 6B317C6510E7C0AFD3139B258C61A61BFB4EF47610F0E45CBD8C48F6A3D229A919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC19A4 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 00BC1A6B

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: d830a50fd064bdb0dd8610bcc5309763ddbf2ef8d49618da99c7babd65a8f268
Instruction ID: dff7f9b262bce6381be3b0e7f936bbbe329bf5d37d6c673269da85dea3c66265
Opcode Fuzzy Hash: d830a50fd064bdb0dd8610bcc5309763ddbf2ef8d49618da99c7babd65a8f268
Instruction Fuzzy Hash: BE31BFB1100340AFE721CB60CC84FA6FBACEF15314F04889AFA489B682D374E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0060AA52 Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 0060AB05

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c912ebcbee2d1a051472d7718a25aa893db8fa9d39a2fc62efc29f6b688193cc
Instruction ID: 01c0ad4641c2e4f92628ec356281a08863980c8a5502cdb790531dde3b6798ab
Opcode Fuzzy Hash: c912ebcbee2d1a051472d7718a25aa893db8fa9d39a2fc62efc29f6b688193cc
Instruction Fuzzy Hash: 153197725083846FE7228B61CC44FA7BFBCEF16214F08849AE9848B652D324E909C772

Uniqueness

Uniqueness Score: -1.00%

Function 0060A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(?,?), ref: 0060A6B9

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f62432874b99138bf3873324076997a2b346536c13e4df103051cbc78dd46ac5
Instruction ID: ee7ccc1a48fb987650e0dec51f428515d06e286fa7d0fd8d96210576f2660c95
Opcode Fuzzy Hash: f62432874b99138bf3873324076997a2b346536c13e4df103051cbc78dd46ac5
Instruction Fuzzy Hash: AA3181B55093806FE711CB65DC85B96BFF8EF16310F08849AE984CB292D375E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1290 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00BC1327

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: cd428b39426f7dfc458b252cddc6fb9e1b0d889b335e620995d1042169f786f8
Instruction ID: c6563a8b4fcb2024e97f6a699c3ae7f32f2acb9b4a3ab8de92e1a6debd3fe575
Opcode Fuzzy Hash: cd428b39426f7dfc458b252cddc6fb9e1b0d889b335e620995d1042169f786f8
Instruction Fuzzy Hash: 7931B4716043846FE7218B64DC44FA6BBF8EF46214F08889AE944DB652D364E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0060ADAD Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0060AE51

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2929cd308041a67fb27787889f0ade96a0fd765e85f7c65556f32d5aff5eecba
Instruction ID: 7981815c6ffba1d88ddb7b5e74520079d404cf1a29face1bed13202d84c115df
Opcode Fuzzy Hash: 2929cd308041a67fb27787889f0ade96a0fd765e85f7c65556f32d5aff5eecba
Instruction Fuzzy Hash: E2318F71504340AFE721CF65DC84FA7BBF8EF19310F08849AE9898B652D375E918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2C46 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 00BC2CE1

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5cbbe37efe0c684a347a2f7a421a81c3581217f966fbd0063ad54bdabd4ca811
Instruction ID: 0978ca9b4095db06359a305c9ffec1818af64f83fd12867eea829ecd48c90069
Opcode Fuzzy Hash: 5cbbe37efe0c684a347a2f7a421a81c3581217f966fbd0063ad54bdabd4ca811
Instruction Fuzzy Hash: 01218D72600604AFEB319F65CC84FABBBECEF28714F04846AE945C7651D724E9098B71

Uniqueness

Uniqueness Score: -1.00%

Function 0060A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060A40C

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3717dc42499de48b89fa9c01e496275e81b017c397988977e5bd751f70a67133
Instruction ID: c0bc727d511838bf50c677578bbeff94e59f8e73a06612eb696ac48a52a56415
Opcode Fuzzy Hash: 3717dc42499de48b89fa9c01e496275e81b017c397988977e5bd751f70a67133
Instruction Fuzzy Hash: 1D318075505780AFE721CF51CC84F93BBF8EF06314F08849AE985CB292D364E909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060BAD0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060BB64

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: d9c965f9883dddf003062ac17675898f2eb66cd7ad3083b76e03bbe50b593b7c
Instruction ID: b6a957ffa3eabed911828784cdd15be2f2ade5ce114433a4c88e6993974d43e8
Opcode Fuzzy Hash: d9c965f9883dddf003062ac17675898f2eb66cd7ad3083b76e03bbe50b593b7c
Instruction Fuzzy Hash: EE21E5B15093805FE7128F21DC45BA6BFB8EF56324F0884DBE984CF193D364AA09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC189C Relevance: 1.6, APIs: 1, Instructions: 85timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC1939

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: e53463ce4defd6676e2be23c773e8b09e0ab503b3eacfe832e8150cd58a6e415
Instruction ID: 578b02fd615ff44af0f3a2ab64425e373e2474e3cc04ca67c957188f3b5f837c
Opcode Fuzzy Hash: e53463ce4defd6676e2be23c773e8b09e0ab503b3eacfe832e8150cd58a6e415
Instruction Fuzzy Hash: 912106B2504340AFE7228F54DC45F96BFB8EF16324F04849AE9458B552D334A909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2F88 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC301F

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 26f63e15c7c58c1aa8ac580ed9a57cc6eee5856731c71be5a2273099124314c2
Instruction ID: 9da0d5779ec676aa4473aa2c1ace7cf8060b76716e5f57c965dcaab52a67cad7
Opcode Fuzzy Hash: 26f63e15c7c58c1aa8ac580ed9a57cc6eee5856731c71be5a2273099124314c2
Instruction Fuzzy Hash: A221D5B25093C05FE712CB20DC54B96BFB8EF56314F08C4DAE9888F193D225A949C772

Uniqueness

Uniqueness Score: -1.00%

Function 00BC19C6 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 00BC1A6B

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 4f7db0b7402cf28875354c9a565c10ccce1fd7dc09c16976945ede94cd86d0fb
Instruction ID: 6f754f7c60d50c166eae831f7f8ba5b74c4b7f2daf097fa3e7770d5895e54f28
Opcode Fuzzy Hash: 4f7db0b7402cf28875354c9a565c10ccce1fd7dc09c16976945ede94cd86d0fb
Instruction Fuzzy Hash: 0F21A371600204AEF720DF64CC84FAAF7ECEF14714F04885AFA499A681D775E5098B71

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2EB9 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00BC2F48

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 24fd6194a5eabe48ac1937c3b04b4088725da06f19dda64a26136f883f15b3e5
Instruction ID: 568577c97ed9279133477bdceaba173610716e2ef37bc7a674907ca09c2faf02
Opcode Fuzzy Hash: 24fd6194a5eabe48ac1937c3b04b4088725da06f19dda64a26136f883f15b3e5
Instruction Fuzzy Hash: 932139755093849FDB22CF25D844BA2FFF8EF06314B0984DAE984CB262D275A909DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0060AEA8 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060AF3D

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 5e7c0499120d2caee599825e19bf280ad3ff6971fa4cc73c4da8d1b691b21aa2
Instruction ID: b14d354eac5a965216e8de2bc84e76fec36ef0b196ef19a5771108aac73b88ce
Opcode Fuzzy Hash: 5e7c0499120d2caee599825e19bf280ad3ff6971fa4cc73c4da8d1b691b21aa2
Instruction Fuzzy Hash: CD212BB55093805FE7128B11DC41BA2BFBCEF16324F0880D6E9448B293D364A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0060A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060A4F8

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8a56b692783cd8cb9dfa7c473c3a0d20b9048bd2f043f3ad4b2fcc93abedc0f3
Instruction ID: e54d8d6637b8fc86071fb84c4b15274abd9e32521283972bf8b6d6a952cbf7f3
Opcode Fuzzy Hash: 8a56b692783cd8cb9dfa7c473c3a0d20b9048bd2f043f3ad4b2fcc93abedc0f3
Instruction Fuzzy Hash: C72190B65443806FD7228F51DC44FA7BFB8EF56214F08849AE985CB692D364E908C772

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0E6A Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00BC0EF6

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 2fe5171b8145b5afd210323a50efe374ba56479a8c8873a2670956318f008998
Instruction ID: 65e292a70c687dbf79bd550e9dfd080b86839442c9b3d4195f43b96dde902d41
Opcode Fuzzy Hash: 2fe5171b8145b5afd210323a50efe374ba56479a8c8873a2670956318f008998
Instruction Fuzzy Hash: BC218271505380AFE721CF51DC45F96FFF8EF09210F04889EE9858B652D375A519CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1446 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 00BC14DA

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 9c9f6023c5006ba38f2f8cd3067160dc64e2f68641093a7c0cf983c041d8f489
Instruction ID: e0683e63133049d8904801a22016dfc1543fe05c3674bb5974d7ce43c0e4b5ca
Opcode Fuzzy Hash: 9c9f6023c5006ba38f2f8cd3067160dc64e2f68641093a7c0cf983c041d8f489
Instruction Fuzzy Hash: 6C21A071505380AFE722CF15CC44F96FBF8EF19214F04889EE9898B252D375E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A078 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 0060A10E

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b3d9e29b6df27ecd0a1bb3595425395ac028c2d22ccad5cc2912c21d554adbf9
Instruction ID: be91cb873ceae83171f343b4568c493a7f3d39d3fffa1e941815ef86d55cda32
Opcode Fuzzy Hash: b3d9e29b6df27ecd0a1bb3595425395ac028c2d22ccad5cc2912c21d554adbf9
Instruction Fuzzy Hash: 1521D37150D3C06FC3128B218C55B66BFB4EF87620F1984CBD884CF693D238A909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0060ADD2 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0060AE51

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ed8268c1c86861db3a87de40fae4feafb9f57d06ee39d292e2e7425d10a73db
Instruction ID: ec7cf9f10ba3d56ac81f79866c57e2bf14effbc5953fa714e90bea50e2aeb0b0
Opcode Fuzzy Hash: 3ed8268c1c86861db3a87de40fae4feafb9f57d06ee39d292e2e7425d10a73db
Instruction Fuzzy Hash: 43219C71600300AFEB20DF65DD85BA6FBE8EF18314F048869E9498B791D375E808DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00BC12B6 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00BC1327

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: e66e7ae37a0a9d5711e91db27ae84e7975c06b31576b9278831443d249d6f3b0
Instruction ID: 93cefbd7ba186882b54e5a8c9bcd0e36e0a1f75c23683cc0a166aac139a95e01
Opcode Fuzzy Hash: e66e7ae37a0a9d5711e91db27ae84e7975c06b31576b9278831443d249d6f3b0
Instruction Fuzzy Hash: A5212971600244AFE720DF69DD44FAAFBECEF45314F04886AE944DBA42D774E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00BC119E Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC123C

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d3e843e386a280de2e8d2f95d365a74d5c3ce342c849ce3ff0db9240609349bc
Instruction ID: 9663766b009403b123c07513e40b123b907eacff112cbc08250cec8ad525c2e5
Opcode Fuzzy Hash: d3e843e386a280de2e8d2f95d365a74d5c3ce342c849ce3ff0db9240609349bc
Instruction Fuzzy Hash: 76219F75505780AFE721CB15CC44F97BBF8EF56310F08849AE945DB292D325E908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0060AA86 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 0060AB05

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0c60f0ba652b9b9ed75e88f85d3054c02ac0babc4375e02daf77a7dd53a96226
Instruction ID: a1b33f7a580fd510c322c8f2ab807e2b4e4a5e51d9750fcd14a3744855b66d06
Opcode Fuzzy Hash: 0c60f0ba652b9b9ed75e88f85d3054c02ac0babc4375e02daf77a7dd53a96226
Instruction Fuzzy Hash: 3C21D1B2600304AEE7209F55CC84FABFBECEF18314F04845AEA448B691D774E5098BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC3087 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC3103

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 6eb55f0db28cb9c76a1b8a9e46a8f8bd8a36651ffa258f80ff65842d7bc0c719
Instruction ID: 04bcfb78c821f74f543f62e3412cf94f49ed42b8ee4a0cfb3d9fc9a210aa7e5d
Opcode Fuzzy Hash: 6eb55f0db28cb9c76a1b8a9e46a8f8bd8a36651ffa258f80ff65842d7bc0c719
Instruction Fuzzy Hash: D02192715053806FE722CF21DC44FA6BFB8EF56614F0884AAE944DB252D375E908CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0060A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 0060A6B9

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4d28553023abcc1651886031c526ca2ed00b52ee92f808193c57eb3c47310f3f
Instruction ID: 61fad3a29eea9e5ab71c1d120fbd8a7e1ba6593f3e1e4c2bc91f8d0588773030
Opcode Fuzzy Hash: 4d28553023abcc1651886031c526ca2ed00b52ee92f808193c57eb3c47310f3f
Instruction Fuzzy Hash: 5C218075600240AFE720DF65DD85BA6FBE8EF14314F08846AE9488B781D775E909CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00BC16DD Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC1760

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: a92d9db30877b433786da5ca84e1e00765961e5518b7194afcd84466df029aae
Instruction ID: a12310aca7e14c657e47dc8e6df9d08ebc758866a4244235641cf9a377b7fffd
Opcode Fuzzy Hash: a92d9db30877b433786da5ca84e1e00765961e5518b7194afcd84466df029aae
Instruction Fuzzy Hash: 572195B15093806FD7128F14DC44B96BFB8EF46224F0884DBE9849B252C368A948C772

Uniqueness

Uniqueness Score: -1.00%

Function 0060A140 Relevance: 1.6, APIs: 1, Instructions: 71networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0060A1C1

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 4b728add320c14877f128d324f85d4ec67eb4b85674d7b3be531e6e4c86044e9
Instruction ID: c02df5df8828e8f497c40a1efbbbd2c4370b946a44ec459aaf0940f488e2c7d1
Opcode Fuzzy Hash: 4b728add320c14877f128d324f85d4ec67eb4b85674d7b3be531e6e4c86044e9
Instruction Fuzzy Hash: E321AC7150D7C09FDB238B60DC94A52BFB4EF07210F0984DBD9848F5A3C279A919DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060B64C Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0060B6C6

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 759e895573ee5b44598a80027dc5740f35f7e5cb99f64baa092b34bde471c852
Instruction ID: 82928ab4115ff57326de606cb9d59f0234bd09e183b1727220f484be3f8c3314
Opcode Fuzzy Hash: 759e895573ee5b44598a80027dc5740f35f7e5cb99f64baa092b34bde471c852
Instruction Fuzzy Hash: A7216FB16493809FD7228F25DC54B92BFB8EF56324F0884DAED45CB293D265E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0C02 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC0C81

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6915c5c28f949b3ab1addcfad5361d91b17502baca113a0265270da4838fe394
Instruction ID: 75089465b406a6f61fb5faf95e733ee6908555ba1038fa6240e87b8fc50b0d5e
Opcode Fuzzy Hash: 6915c5c28f949b3ab1addcfad5361d91b17502baca113a0265270da4838fe394
Instruction Fuzzy Hash: 7A219F71505380AFDB22CF51DC44FA7BFB8EF59314F08849AE9849B652D335A908CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0060A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060A40C

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2acad5f79d36f5eee3fa28255e0960c4e712f25707b8fe7ba6c0c4d4853413a4
Instruction ID: 6f71160e9ded76839ffa8c196533cb0cee324d7a9f25a38eaaed9a8943bb0416
Opcode Fuzzy Hash: 2acad5f79d36f5eee3fa28255e0960c4e712f25707b8fe7ba6c0c4d4853413a4
Instruction Fuzzy Hash: 34218B75200300AEE720CE55CC84FA7B7E8EF14754F04846AE945CB691D360E809CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2DF3 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC2E6F

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 93cb0fdb88754cf3c2914e8c877c2c3ed15204550eac8f64ae386e3bc6f3a7e8
Instruction ID: bf2a0d498c45fef401ca30436770ac15301f2de45620926d211f4e5fda536d49
Opcode Fuzzy Hash: 93cb0fdb88754cf3c2914e8c877c2c3ed15204550eac8f64ae386e3bc6f3a7e8
Instruction Fuzzy Hash: D921C371509380AFE722CF10DC84FA6BFB8EF55314F08849AE9489B252C374A908C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0060AB4D Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060ABCB

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 71833cbe874048d907e094bafd1191f15ebdaf4943fa323fe6a68b5b539e6d50
Instruction ID: 944386e19a4487e25123b92b6b4fd462942791b61d07f81a9a9c463d3557ce0f
Opcode Fuzzy Hash: 71833cbe874048d907e094bafd1191f15ebdaf4943fa323fe6a68b5b539e6d50
Instruction Fuzzy Hash: 2A21C2B15093C05FEB16CF25D885B92BFE4EF06324F0984DAE9858B267D2649849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060B930 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060B99C

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c7b43e89bfb1ffd26a24e11b3d43e133b69cdad7e9e8b196bcb7b39c196a8eb9
Instruction ID: 8fe750eaed194de353263dd42bf18daf22b95c5407a3ff18238fce4f17314625
Opcode Fuzzy Hash: c7b43e89bfb1ffd26a24e11b3d43e133b69cdad7e9e8b196bcb7b39c196a8eb9
Instruction Fuzzy Hash: BB21C3B25093C05FDB128F25DC54692BFB4AF07324F0984DBE9858F663D2749908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0E8A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00BC0EF6

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: ccbe7fd9fc065005da65a028807c120f8f10b2f94720d79eff6777731c18e190
Instruction ID: 59663b4ea837409557854e148bd928123d99f0108c40b2889fad85349c1a931e
Opcode Fuzzy Hash: ccbe7fd9fc065005da65a028807c120f8f10b2f94720d79eff6777731c18e190
Instruction Fuzzy Hash: 6C21D171500200AFEB21DF55DD84FA6FBE8EF08320F0488AEEA498B651D375E418CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1B76 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00BC1BF2

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 263d7002f850fd485f5d15e2490980b53dffc9701576c9f7cb817c25052ffdc6
Instruction ID: d548ff0656671423644d0d3ede57d57dd4b570c46bb02c2e09a3804c906486d0
Opcode Fuzzy Hash: 263d7002f850fd485f5d15e2490980b53dffc9701576c9f7cb817c25052ffdc6
Instruction Fuzzy Hash: F8216F71508780AFDB228F55DC44B62BFF4EF0A310F0888DAE9859B663D275A819DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1466 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 00BC14DA

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: dfd3c4e0a8019641222dd1f255bcfc57684e38b9c28f1de89b33a75e0fda9f5c
Instruction ID: 0e28f906b5830b93a18f322ea3323d06862902efdcfe7529fc7780b056d37bf4
Opcode Fuzzy Hash: dfd3c4e0a8019641222dd1f255bcfc57684e38b9c28f1de89b33a75e0fda9f5c
Instruction Fuzzy Hash: B121A171500200AFEB21CF55DD85FA6FBE8EF19324F0488ADE9499B652D375E508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1F32 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 00BC1FBB

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 236075ce8a734ca5b62f1aa36d19c77e6e470a6b3b2e70ad6f2186dd5f4c6f35
Instruction ID: 0bb4204fdb0ec06f2ffc5ec121bbb5281159832bba80dc90e7331250ae6e1665
Opcode Fuzzy Hash: 236075ce8a734ca5b62f1aa36d19c77e6e470a6b3b2e70ad6f2186dd5f4c6f35
Instruction Fuzzy Hash: DD11B1715053806FE721CB15DC85FA6FFB8DF56720F08849AFA489B292D364A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060A4F8

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b0ef1307c76eebaac09803577456834e5f070f5373ee629350482a8ad4bfd815
Instruction ID: f662e03d0dc76b4045f89e73f64e98fa0cf04e3050e4bf106a35efdb67de4ca5
Opcode Fuzzy Hash: b0ef1307c76eebaac09803577456834e5f070f5373ee629350482a8ad4bfd815
Instruction Fuzzy Hash: 0F11B1B6640700AFE7218F55DC45FA7BBECEF18714F04845AED458A781D370E808CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC11CA Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC123C

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4c61b3037e4231f259aa1b7bbc1c36d28fd90d9ff0d2735a26c0ca1061948a29
Instruction ID: 56671cbfd3470094ca9a7943e17628e1ba58d2fcfc0f0b3fa31edb1028f691c9
Opcode Fuzzy Hash: 4c61b3037e4231f259aa1b7bbc1c36d28fd90d9ff0d2735a26c0ca1061948a29
Instruction Fuzzy Hash: EA11A275600600AFE720CF15CC84FA6F7E8EF15724F14889AE945DA652D760E908CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0060ACE8 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060AD52

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 3c7f164f417d2ec527954fe784db5c70778a036ef0bf19a3cdf34f65415ca134
Instruction ID: 15f0097d7ddb16d85559eabcf818dee767dfe8c46d1682d18816d8b287d95b68
Opcode Fuzzy Hash: 3c7f164f417d2ec527954fe784db5c70778a036ef0bf19a3cdf34f65415ca134
Instruction Fuzzy Hash: FD1184B16453805FD721CF65DC85B97BFE8EF06310F0884AAE985CB692D274E808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A710 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58,?), ref: 0060A780

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6181b9cbc03b00e6457ed6822f96a26bcaef45ce2674659b13a935e1e0689363
Instruction ID: 72f225177c13121389c14426f8eeb261eda24d09381864c51370db8f57e4ce20
Opcode Fuzzy Hash: 6181b9cbc03b00e6457ed6822f96a26bcaef45ce2674659b13a935e1e0689363
Instruction Fuzzy Hash: BB21E4B55043809FD711CF55DD85792BFB8EF02324F09849BED458B693D3349909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC18DA Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC1939

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 3b2d123ec31c61be328ea2059583cea4759082111e9cd1ae78fe014c56d1acd1
Instruction ID: bc365423eac306313a50a0e84077f5a9ec286c3c6a872575456cf00f3cb51c94
Opcode Fuzzy Hash: 3b2d123ec31c61be328ea2059583cea4759082111e9cd1ae78fe014c56d1acd1
Instruction Fuzzy Hash: 2A11E672600200AFFB218F55DC84FAAFBE8EF15314F04886AE945DB651D375E5098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00BC30AA Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC3103

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 65fc23887b6ee0961627258aa87d07227d363494e9dbd4a4be397566ff08464a
Instruction ID: 781241d290e3465eeafb04de44de64e6b5adcbf187851ad039f539e981f2fd94
Opcode Fuzzy Hash: 65fc23887b6ee0961627258aa87d07227d363494e9dbd4a4be397566ff08464a
Instruction Fuzzy Hash: 0911C471600200AFE721CF15DC85FAAB7E8EF14724F08C4AAEA45DB641D775E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2FC6 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC301F

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 65fc23887b6ee0961627258aa87d07227d363494e9dbd4a4be397566ff08464a
Instruction ID: cca745a323ce76ab815b1ec26259d98e89767418a10415a78bff22cc604dd85d
Opcode Fuzzy Hash: 65fc23887b6ee0961627258aa87d07227d363494e9dbd4a4be397566ff08464a
Instruction Fuzzy Hash: 9711C472600200AFEB20CF15DC84FAAF7E8EF14724F04C4AAEE45CB641D775E5488AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0060BB0E Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060BB64

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 2c8ad47442ac0d13d71e8f4cfeb0f5786ad4bb4517dc35fbe2273ce665e67ab2
Instruction ID: 30b8da4a679649ecd0e89041e6cbe569677743a09602427803d21372339bb29c
Opcode Fuzzy Hash: 2c8ad47442ac0d13d71e8f4cfeb0f5786ad4bb4517dc35fbe2273ce665e67ab2
Instruction Fuzzy Hash: E111E371600200AFEB208F15DC85BABB7A8DF44324F14C46AED04CB685D774E908CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0060BDE4 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060BE46

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: f8c3e2329b7f3c07ecadee6e303e4247a6920e985aa1199b9cb184e8047eb265
Instruction ID: 276f5ecee06c9ad8d68b9cf32bccb961e4cbc6a31d7584d11fc1751ab436e0e0
Opcode Fuzzy Hash: f8c3e2329b7f3c07ecadee6e303e4247a6920e985aa1199b9cb184e8047eb265
Instruction Fuzzy Hash: 861172715053809FD711CF65DC84B96BFE8EF05210F0884AAED45CB262D274A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0C22 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC0C81

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4be10d3731e315515aef55f206f2bc588f31a25f814845ea9dd1b5a3b0d14296
Instruction ID: 63672856795d5cda9d6588f3bc59ae6a43100e2e236ceb474ab6ef410857757d
Opcode Fuzzy Hash: 4be10d3731e315515aef55f206f2bc588f31a25f814845ea9dd1b5a3b0d14296
Instruction Fuzzy Hash: 48110471600200AFEB21CF54DC80FA7FBE8EF18314F0484AAEA448B641C335E5088BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2E16 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC2E6F

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ab590aa91c3dde49113bc5efb58a9246ca6e360933b8b2fd3345f6894fde5159
Instruction ID: b26e9c6f160b25879c21b450b7d8178549e38cf78760d59fccead7d73e6a7b04
Opcode Fuzzy Hash: ab590aa91c3dde49113bc5efb58a9246ca6e360933b8b2fd3345f6894fde5159
Instruction Fuzzy Hash: 6911E371600200AFE720CF14DC84FA6FBE8EF54324F04C4AAEE489B641C374E5088AB2

Uniqueness

Uniqueness Score: -1.00%

Function 0060A9B5 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060AA14

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b7fcf15075cc80d3e9c7d4e2efeec3a82cf2f871b76d77f8e84473083cee2fd8
Instruction ID: 44f2d7a5e03eec0667314c299e1df7afe1a91468e3f54e0963222535eb1782f5
Opcode Fuzzy Hash: b7fcf15075cc80d3e9c7d4e2efeec3a82cf2f871b76d77f8e84473083cee2fd8
Instruction Fuzzy Hash: 13116D715493C09FDB128F65DD44A92BFB4EF47220F0884DAED848F293C279A948DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC170A Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 00BC1760

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 3109632e9a6957e5142fd189b5ea8a9709a7f87418792fa5c71e39e6435e878b
Instruction ID: dcc6baa5144ee7690c56d369d2d88f3f8b367f26f52ebe4b9a9cfd771265b3b8
Opcode Fuzzy Hash: 3109632e9a6957e5142fd189b5ea8a9709a7f87418792fa5c71e39e6435e878b
Instruction Fuzzy Hash: 1C11C6B5600200AFEB21CF15DC84FA6B7E8DF59724F14C8AAED449B641D774E9088AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0060A2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060A330

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 418662241d877ed3d0eacb54cc07967f65f9377bc6a02195f940f64503c75d5e
Instruction ID: b752e831b5eb6cd1dcf2f18dbbb7020f32118088e60039e503ba6b838a97d48b
Opcode Fuzzy Hash: 418662241d877ed3d0eacb54cc07967f65f9377bc6a02195f940f64503c75d5e
Instruction Fuzzy Hash: E11191715493C06FDB228B25DC54A62BFB4DF47224F0D80DBED848F2A3C265A918D772

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0170 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BC01D6

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4ed7dba4f146faee9894adfd1c270be6f0ab25c378a98213f75965fc73f5081b
Instruction ID: 9e6388bca45e4016f183bf17a52633ed2b3c1b9f45411fbe61560c51795f5f4a
Opcode Fuzzy Hash: 4ed7dba4f146faee9894adfd1c270be6f0ab25c378a98213f75965fc73f5081b
Instruction Fuzzy Hash: EC119371504780AFDB218F51DD44B52FFF4EF4A320F08889EEA858B562C275A819DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1F52 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 00BC1FBB

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5efc23cd19089d46d4f65f978f1b6e72db7172bccf2ed8cb9899df100806928a
Instruction ID: 3fba81e1b811b0c9b8f3d4e220448af470109860aa5a2003bb8781c0f3ef44ec
Opcode Fuzzy Hash: 5efc23cd19089d46d4f65f978f1b6e72db7172bccf2ed8cb9899df100806928a
Instruction Fuzzy Hash: F311E571600200AEE720DB15DD81FB6FBE8DF15724F14C49DEE485A781D3B4E908CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2EF2 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00BC2F48

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: a0eaba14356df9777cd2e9eb30d97f83d337fb75d152f0d5434e2f3be84f1e6b
Instruction ID: ace3659c9377e105f50a49f4de54fcdd70c4ea132ace4d48ef06990704087eb1
Opcode Fuzzy Hash: a0eaba14356df9777cd2e9eb30d97f83d337fb75d152f0d5434e2f3be84f1e6b
Instruction Fuzzy Hash: 4011E9756002449FDB20CF59D984FA6FBF8EF04710F0884AEDD49CB651D775E948CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0060B67E Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0060B6C6

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5428458a75e3a12518e763ca45dfbbc1b1b2b543dcddb0f9cb90fc62cd05e638
Instruction ID: d920bd6a0e6f96f2ee2f558ccc78b087becea4be5b18dca9a31e9cc57278daeb
Opcode Fuzzy Hash: 5428458a75e3a12518e763ca45dfbbc1b1b2b543dcddb0f9cb90fc62cd05e638
Instruction Fuzzy Hash: 7D1170716102408FEB24CF29D884BA6BBE8EF04324F08C46AED45CB781D375E804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060AD0A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060AD52

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 5428458a75e3a12518e763ca45dfbbc1b1b2b543dcddb0f9cb90fc62cd05e638
Instruction ID: 1f042978ad0ba999cc1cf0bc6efcbf3a69178bb4d650e1f713c4eda5cb36177c
Opcode Fuzzy Hash: 5428458a75e3a12518e763ca45dfbbc1b1b2b543dcddb0f9cb90fc62cd05e638
Instruction Fuzzy Hash: 4E1170B26403009FDB24CF69D985757BBE8EF04351F08846ADD45CBB81D674D804CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0060AEEA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,DA482954,00000000,00000000,00000000,00000000), ref: 0060AF3D

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 313104f1a0c7ce33cbe815f3ba49530a6a501f13b2a6b2dbd6701c292f0d9cff
Instruction ID: 88204a115815acd1ece00802f3b63a27fb94d68dc36f9ce8d3446215f077114e
Opcode Fuzzy Hash: 313104f1a0c7ce33cbe815f3ba49530a6a501f13b2a6b2dbd6701c292f0d9cff
Instruction Fuzzy Hash: BB01D6B5640300AEE720CF55DD84BA7F7E8DF14724F14C0A6EE448B781D374E5098AB6

Uniqueness

Uniqueness Score: -1.00%

Function 0060A918 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 0060A96F

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: fdb02b3ab5f546322d7929902dbdcbc7d620a8fc8f24ad332af5bf76622313f3
Instruction ID: 7876068fbb049eb484fa9030b5e3c7a4aaf4d817eec13c8bffedb8b9fb93bb64
Opcode Fuzzy Hash: fdb02b3ab5f546322d7929902dbdcbc7d620a8fc8f24ad332af5bf76622313f3
Instruction Fuzzy Hash: BB11A0715483809FDB118F55DD84B92FFB4EF46320F0984DAED848F262D279A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060BE06 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060BE46

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 61e94e7def2533ef99346eb96b9fcef997a229f0f06beed312c10d9fd04939a0
Instruction ID: 093b864012293b7b475c0137533dcc2e58a425504b0fb66b9f89adc9c32416e0
Opcode Fuzzy Hash: 61e94e7def2533ef99346eb96b9fcef997a229f0f06beed312c10d9fd04939a0
Instruction Fuzzy Hash: D51161716006449FEB24CF25D984BA6FBE4EF04760F08C4AADE49CB795D375E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1BA6 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00BC1BF2

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: a126ab5c9d2929d250bf11b18bb54dd56628dcb596d6b0e38412db6ebed1d311
Instruction ID: 4387466b26991afee42e3040f3ec9bd4db2047cce7d3a7a61eceb94f40651002
Opcode Fuzzy Hash: a126ab5c9d2929d250bf11b18bb54dd56628dcb596d6b0e38412db6ebed1d311
Instruction Fuzzy Hash: 081170716006409FDB20CF59D984B62FBE4EF09310F0888AAEE459B652D335E818DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0060AB8E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060ABCB

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8b5ff54098a5bd03883cd1376b6eae66e8721a2be90463ae64beb750dc2f9b51
Instruction ID: e7eda35d040dad23d14cfe2721aa065cdc4975677db2c6eca50bfa5746e29657
Opcode Fuzzy Hash: 8b5ff54098a5bd03883cd1376b6eae66e8721a2be90463ae64beb750dc2f9b51
Instruction Fuzzy Hash: BD0184716403409FEB24CF55D984766FBE5EF04360F0884AADD45CB781D675D844CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A0BE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 0060A10E

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b441f884bf0d570af35aaa2588532432249a31f8645551bef997afea7dd1f260
Instruction ID: ad1cb5a2ef29531f03be5172eaf4e2458e7939320f3a4f1a77444aff349f7b04
Opcode Fuzzy Hash: b441f884bf0d570af35aaa2588532432249a31f8645551bef997afea7dd1f260
Instruction Fuzzy Hash: 0B015EB1600200ABD310DF16DD45B76FBA8FB88A20F14855AED089BB41D735F915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BC1CC6 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 00BC1D16

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: babd1bdc40c389f2f51ec55f88ca4f1870c2dc5a8f808475f7e4a69088a93b0e
Instruction ID: d8a1b680722184826520812d70a61ba1f51264ec10ece2976e5da73c5a6653f1
Opcode Fuzzy Hash: babd1bdc40c389f2f51ec55f88ca4f1870c2dc5a8f808475f7e4a69088a93b0e
Instruction Fuzzy Hash: 15015EB1600200ABD350DF16DD45B76FBA8FB88A20F14855AED089BB41D735F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0192 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BC01D6

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2ce3ac6a71b8657dc1ef5d89a69718c72852a241bf6b0eef83effb04c13ff8a3
Instruction ID: 3555b881ba7364f83551d813c1d751ecaabf9e48b31eae0a44bda9446dc8c665
Opcode Fuzzy Hash: 2ce3ac6a71b8657dc1ef5d89a69718c72852a241bf6b0eef83effb04c13ff8a3
Instruction Fuzzy Hash: 6A018E31500700DFDB218F55D984B52FBE0EF08314F0888AAEE459A611C235E418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0060B96A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060B99C

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9b2941f30fcfa46e51ee9776281d58f54b0f4c0a292dc1f1a6c70960537eb3e9
Instruction ID: 86acc466c788a0f100e354ad15c8bfc8bb1fc0f2f3254a4d034a54f749aa31b9
Opcode Fuzzy Hash: 9b2941f30fcfa46e51ee9776281d58f54b0f4c0a292dc1f1a6c70960537eb3e9
Instruction Fuzzy Hash: 7901D4716002408FDB10CF19E984796FBE4EF05324F08C4AADE498F785C375E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58,?), ref: 0060A780

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b572ba502b63a6d7bb3df724354ec5f238b6e4cea6f78eb39f1b7f8a0ba81b8e
Instruction ID: 31ff96e76b157153e8318379041a1350f109b36920e98117a052d45929b8f34b
Opcode Fuzzy Hash: b572ba502b63a6d7bb3df724354ec5f238b6e4cea6f78eb39f1b7f8a0ba81b8e
Instruction Fuzzy Hash: 8E01D4756003408FEB108F55D9847A6FBE4DF04320F08C4ABDD458B782D275E408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0DEE Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 00BC0E3E

Memory Dump Source

Source File: 00000000.00000002.4081928156.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2dd38e4720f4b90e89621e633d68895ea7377a0fc657c108bc0e127b89c93939
Instruction ID: 4a9cd30b3d901c7aa871ac7c90aae4951d5f376addae26026adde534463750a3
Opcode Fuzzy Hash: 2dd38e4720f4b90e89621e633d68895ea7377a0fc657c108bc0e127b89c93939
Instruction Fuzzy Hash: A901A271600200ABD310DF16DC46B76FBE8FB88A20F14811AED089BB41D771F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0060A186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0060A1C1

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: ecde1a8e6cdb03ff433cfa4b5c4a63aeb0120ad4d2ef0359d6a2bea24b12d76a
Instruction ID: b3ecde616e9729665319d67ab324c9dee96c9b169fb9c3c959645984b25dd173
Opcode Fuzzy Hash: ecde1a8e6cdb03ff433cfa4b5c4a63aeb0120ad4d2ef0359d6a2bea24b12d76a
Instruction Fuzzy Hash: 31019E715443409FDB20CF55D984B62FBE0EF04360F08C8AADE498B651C275E418DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0060A93A Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 0060A96F

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 5198431fabcc79c4fea118c36c08ee19ddc13cf058fc69fdac85e52343bcb97f
Instruction ID: 1416da9bae6ba5b69edac52ad62e2e0eb71a19a15bb81af2876eb6de122d1dee
Opcode Fuzzy Hash: 5198431fabcc79c4fea118c36c08ee19ddc13cf058fc69fdac85e52343bcb97f
Instruction Fuzzy Hash: 8A018471A042409FDB10CF55D984766FBE5EF04324F08C8AADD448B755D275D408CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 0060A9E2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060AA14

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: de43c55fcb03398405db9ca219ca3671d9505c7e5ec813527c1372abd8f1bb59
Instruction ID: 15b4bcda9ae84e7b6d2d0ca369ee6ba512108de049e9fda2f5eba6e60af11347
Opcode Fuzzy Hash: de43c55fcb03398405db9ca219ca3671d9505c7e5ec813527c1372abd8f1bb59
Instruction Fuzzy Hash: FF01A2716403409FDB20CF55DA84762FBE4EF44324F08C4AADD498F786D279E408CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0060A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,DA482954,00000000,?,?,?,?,?,?,?,?,6C8C3C58), ref: 0060A330

Memory Dump Source

Source File: 00000000.00000002.4081364218.000000000060A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0060A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60a000_NezbdhNgwG.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e9cb5fd2b398b8a4eaad36f672ace33b13cc92b119f180f5fea97eb5aca8d046
Instruction ID: 0db1652c6b4e051355d6a9f1421005b86e3c0c1549730c7f6364408b5fc78644
Opcode Fuzzy Hash: e9cb5fd2b398b8a4eaad36f672ace33b13cc92b119f180f5fea97eb5aca8d046
Instruction Fuzzy Hash: 91F081759443409FDB248F19D984762FBA0EF04764F08C0AADD494B792D275E808CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 00BD109C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56de7c32b55ca5b5fec773a1fad2ab583bf9cdfe9f714df067edec2d46a66215
Instruction ID: 3484044557360b8c88fcb0fcafe671793c6dd41e91461087ad2bb8f0ef261fa6
Opcode Fuzzy Hash: 56de7c32b55ca5b5fec773a1fad2ab583bf9cdfe9f714df067edec2d46a66215
Instruction Fuzzy Hash: D5214C7150D7C09FD7138B24D991B62BFB8EF03614F0A88DBD9848F663C2295808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1070 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f14f5892f200518bbf8a86fdbfbe029d6d8f9d682af08862aae58f2c30fcc2c
Instruction ID: 35307727e43f639f5190e18fc63e04654e2cc8b580c7368359af45610ac8690c
Opcode Fuzzy Hash: 0f14f5892f200518bbf8a86fdbfbe029d6d8f9d682af08862aae58f2c30fcc2c
Instruction Fuzzy Hash: 8121A4715097C0AFD712CF18DC94B52FFE8EB02714F0988DBE9449B653D269A808C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 051126C0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4083807654.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5110000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd67a69ed586f11c5cae9ccb0ce4046e6d8681c09356895892058073a6d17aca
Instruction ID: 390cd63d02b5588b1a20dea0fbc80a401389fa508731a46ed10d9c8aaecb42b6
Opcode Fuzzy Hash: fd67a69ed586f11c5cae9ccb0ce4046e6d8681c09356895892058073a6d17aca
Instruction Fuzzy Hash: A011CEB5608341AFD350CF19D940A5BFBE4FB88664F04896EF998D7311D231E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0934 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1200378a80cab8e13dd4cd6bcae2d22f345390b7780fcf938e3e8676424d81c0
Instruction ID: 9a4978ff447154c419b057765fb916f9d63b45078f7877f6ebe7aed27806ce4d
Opcode Fuzzy Hash: 1200378a80cab8e13dd4cd6bcae2d22f345390b7780fcf938e3e8676424d81c0
Instruction Fuzzy Hash: 3211E4302142809FE311DB18D590B25FBE5EB89718F24C9EEE8490B753D73BD842CA41

Uniqueness

Uniqueness Score: -1.00%

Function 00BD08FC Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882a278362c4221a8f89f927d3d877134c804e0931212dc0bad7b6872163d96b
Instruction ID: 56e7edc54342e037410fb701f2af894351e38fdd5b20a184e36440460951528d
Opcode Fuzzy Hash: 882a278362c4221a8f89f927d3d877134c804e0931212dc0bad7b6872163d96b
Instruction Fuzzy Hash: C1215E315093C48FC703CB20C960B55BFB2EF56318F1986DED4859B653D33A9806CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0081B858 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081628580.000000000081A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81a000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcc5a0a287280fedb43fad3ef82a3f53aa5f75bed939c601291998b1480d670
Instruction ID: ca84f031b123974c35b301aec02543ed81f4e38fec7d365ed710858869e32973
Opcode Fuzzy Hash: 6dcc5a0a287280fedb43fad3ef82a3f53aa5f75bed939c601291998b1480d670
Instruction Fuzzy Hash: 9911C0B5608301AFD350CF19DD41E5BFBE8EB88660F148D6EF95997311D271E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD10F6 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83892f2c806fc00744f05a98d16e217d1e691aafdcd9d451efb3e9420d0436c
Instruction ID: 1a20d4857cd1cd9961440d1a79c6f91119c0c4186be57767bdfd4e85e3d56321
Opcode Fuzzy Hash: b83892f2c806fc00744f05a98d16e217d1e691aafdcd9d451efb3e9420d0436c
Instruction Fuzzy Hash: 0A01B171608680EED7118F19DAC0762FBE4EB45724F08C8ABDE494BB01D3799848CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD05E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62da5f94af26c5af75d547a16a6620827f3e325373d4cbd0a78a2f02c19554a4
Instruction ID: a6dc531d6f816b799ce65fa811562165bae4768232da135e088a1ab413daa3b7
Opcode Fuzzy Hash: 62da5f94af26c5af75d547a16a6620827f3e325373d4cbd0a78a2f02c19554a4
Instruction Fuzzy Hash: A10162B65097805FD7128F15AD418A2BFB8EF8662070984EBE9498B612D225B909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BD09F0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98923c3d1ea22da9be8346e03fd0310872bdf3a94fd5444d8394cfb273c2f72
Instruction ID: 061e21c19f089b9bd6ee9bcec994c4e8f8237e10e8889ed33bb239e9caaebc79
Opcode Fuzzy Hash: e98923c3d1ea22da9be8346e03fd0310872bdf3a94fd5444d8394cfb273c2f72
Instruction Fuzzy Hash: 7DF0FB35104645DFC205CF04D580B15FBE2FB89718F24CAA9E94907752C73BE812DA81

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081941915.0000000000BD0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da36a59205e72fcf05faa1349bc4d028ac27696ddf5c876c2733ca77b0104ba4
Instruction ID: 03f00fb78f48ab4f7b00f1cb094534208e10ca89db4c07fa20673a463be66e7e
Opcode Fuzzy Hash: da36a59205e72fcf05faa1349bc4d028ac27696ddf5c876c2733ca77b0104ba4
Instruction Fuzzy Hash: 73E092B66006404B9650CF0AFD41462F7D8EB84630708C47FDD0D8B701D235B509CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 0511272B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4083807654.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5110000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e27811e420e3a946488b2c2973e7a79ede9666f8397036b2d468b711d7b3e7
Instruction ID: a8b6c9dcdf9b0ee741927c1a144b00ab752fabf1aee1a476ad481264f6ad8a6a
Opcode Fuzzy Hash: f1e27811e420e3a946488b2c2973e7a79ede9666f8397036b2d468b711d7b3e7
Instruction Fuzzy Hash: 0BE0D8F264020067D2508F0AAC45F62FB9CDB44A31F04C467EE081B741D171B51889E2

Uniqueness

Uniqueness Score: -1.00%

Function 05111FD7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4083807654.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5110000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e53689726b0486973ec5b370a4dd62f77e92229ae6bafc3a22e1b10c311225
Instruction ID: 2a4c91fba30e0454f86d9d78cc88de48ebe1340336bca01e7398c2eaaa125e82
Opcode Fuzzy Hash: 35e53689726b0486973ec5b370a4dd62f77e92229ae6bafc3a22e1b10c311225
Instruction Fuzzy Hash: C6E0D8F260020067D2509F0AAC45F63FB98DB40A30F08C467EE081B701D172B518C9E2

Uniqueness

Uniqueness Score: -1.00%

Function 0081B8A7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081628580.000000000081A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81a000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c1df5581df64d0aa68794c0910ee533f7a4477a4a8b5747e64aec10facfa05
Instruction ID: bd89b183f930aee56e0ec6f77d578757446d2d69e5a06e66180f4016d9178910
Opcode Fuzzy Hash: b6c1df5581df64d0aa68794c0910ee533f7a4477a4a8b5747e64aec10facfa05
Instruction Fuzzy Hash: 0DE020F264020467D2508F06EC45F63FB9CDB44A31F04C567EE085F701D171B50889F2

Uniqueness

Uniqueness Score: -1.00%

Function 006023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081351710.0000000000602000.00000040.00000800.00020000.00000000.sdmp, Offset: 00602000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_602000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bebc3fbf2bef446841490121b93779a66ab9c332576a6f161bd1ddf1e546940
Instruction ID: 3160b9750afbd3fc95ad3fd2bdf5bb17c5390f88f27fa2a3edd0a68f7792f24f
Opcode Fuzzy Hash: 5bebc3fbf2bef446841490121b93779a66ab9c332576a6f161bd1ddf1e546940
Instruction Fuzzy Hash: 27D02E792416C24FD32A8A0CC2A8BC637D4AF40704F0A04F9AC00CB7A3C768D8C1C200

Uniqueness

Uniqueness Score: -1.00%

Function 006023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4081351710.0000000000602000.00000040.00000800.00020000.00000000.sdmp, Offset: 00602000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_602000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6e0399281cc775d7207225aa35d18825810d58e671afc52a58cbb9a5ab8551
Instruction ID: 0a3f8abb4e2e834e8a1fa569f974f6d7c2f585f0129900532cbd98fc42117d63
Opcode Fuzzy Hash: 8b6e0399281cc775d7207225aa35d18825810d58e671afc52a58cbb9a5ab8551
Instruction Fuzzy Hash: D3D05E342402824FCB2DDA0CD2E8F9A37D9AF40714F1A44E8AC108B7A2C7B8DCC1DA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NezbdhNgwG.exePID: 6232, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C9A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00C9A6B9

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b173906305696665e6b84b0bf4d5564b7488a6c55de2c88184a0c8610fa21565
Instruction ID: e7c26a26a0a6aa9a252a4432d98e0d9daa56af700bac1d4c37da20a36d2474e1
Opcode Fuzzy Hash: b173906305696665e6b84b0bf4d5564b7488a6c55de2c88184a0c8610fa21565
Instruction Fuzzy Hash: 4A3181755093806FE712CB65DC85B96BFF8EF16310F08849AE984CB292D365E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,ACD8C2D9,00000000,00000000,00000000,00000000), ref: 00C9A40C

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0bd8a2e9c9093b57a53b0ae6de9d711ce687f57068660fc3f9fe6dedf2686c50
Instruction ID: 9b000132ee7ba3495399c83d3a7850ccde2e7ecc50b6f23d0f0ef8c51ba0f5ce
Opcode Fuzzy Hash: 0bd8a2e9c9093b57a53b0ae6de9d711ce687f57068660fc3f9fe6dedf2686c50
Instruction Fuzzy Hash: D5317375505744AFE721CF11CC88F92BBF8EF16714F08849AE945CB6A2D364E909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,ACD8C2D9,00000000,00000000,00000000,00000000), ref: 00C9A4F8

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a580400c8591b648f2a69003daffba410c984f129201eb0e16f95cf612304df0
Instruction ID: 71dbd0148452958b42444a5aea9219341aa8385c695aa3593203cf9a517b51e9
Opcode Fuzzy Hash: a580400c8591b648f2a69003daffba410c984f129201eb0e16f95cf612304df0
Instruction Fuzzy Hash: 7421A4765057806FDB228F11DC44FA7BFB8EF56314F08849AE985CB652D364E908C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00C9A6B9

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: febd7bdd7fea8912c7041aae59e2838c48bd3dd04b0cf9489a8f52ee3d1c8b50
Instruction ID: ee06232ca5a5f4bede8058d94c990342f900631abd0199d5fc6ab94b8809cf12
Opcode Fuzzy Hash: febd7bdd7fea8912c7041aae59e2838c48bd3dd04b0cf9489a8f52ee3d1c8b50
Instruction Fuzzy Hash: 982195756002009FEB20DF65DD85BA6F7E8EF14314F08846AED498B741D775E909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,ACD8C2D9,00000000,00000000,00000000,00000000), ref: 00C9A40C

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: adaf9a749032f3c22798a5fc3da2ab21a70bc6da3be6898e71e2a03f87e2ac30
Instruction ID: becd8a5ad98ebbc6480a47670a309ddf9232b31a83cc1c0ecede864dc2c7b722
Opcode Fuzzy Hash: adaf9a749032f3c22798a5fc3da2ab21a70bc6da3be6898e71e2a03f87e2ac30
Instruction Fuzzy Hash: 3B216075600604AFEB20CF15CC88FA6F7ECEF18714F14846AE946CB651D764E909CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,ACD8C2D9,00000000,00000000,00000000,00000000), ref: 00C9A4F8

Memory Dump Source

Source File: 00000004.00000002.1844449448.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c9a000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3c8efc49cecb38b25fadb5e254b19b808e3e9db2f37d51116f0362d8f6772e2b
Instruction ID: 172d737d8fa0be89e2d51acdbeea8bfb0d67da55bb4030ee81c26de1941b324d
Opcode Fuzzy Hash: 3c8efc49cecb38b25fadb5e254b19b808e3e9db2f37d51116f0362d8f6772e2b
Instruction Fuzzy Hash: BD119376600604AFEB218F15DC49FA7FBECEF18714F04845AED498A651D774E908CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0310 Relevance: .2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844648966.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_de0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae14371eefb44940389995abee898dce494bf0dafc7d08d47e8ecb36fc28e13
Instruction ID: fd658e68193567d50ebcd757668600f5c279cef39a965e2f0ee695c89f29e152
Opcode Fuzzy Hash: 6ae14371eefb44940389995abee898dce494bf0dafc7d08d47e8ecb36fc28e13
Instruction Fuzzy Hash: 685110307041408FCB28BB79946566E7AE7AB86308B18447DE402DF3E5DF79CD46D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0369 Relevance: .2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844648966.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_de0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749302dc1b56d7b6427682d561c078a1da9977efcdf581f1de4b32601fdebf84
Instruction ID: f6c03ced45c5068e0ce5e6fb9ebb3609c13e5fdc50cbaa750ba932d13db8a2a8
Opcode Fuzzy Hash: 749302dc1b56d7b6427682d561c078a1da9977efcdf581f1de4b32601fdebf84
Instruction Fuzzy Hash: 3851EF307041018BCB18BB79945567E36E79B86348B14447DE402DF3A4DFB9CD4697A2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE03BD Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844648966.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_de0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd6b529dc40a714f2f4f979dd2249cc869551e39be4ee7f43086b871fc921d1
Instruction ID: f06e56e1fe59c4534af80998e75323d3ddab5e60499b1a136bfe3ca98f6db878
Opcode Fuzzy Hash: 9bd6b529dc40a714f2f4f979dd2249cc869551e39be4ee7f43086b871fc921d1
Instruction Fuzzy Hash: E941DB31B041514B8B28B77A94652BE36D79FC6348718447DE002DF3E5DFA9CD06A7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0088 Relevance: .1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844648966.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_de0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67509b2d03e0cbdf339a13aa13b161fb11436c1d77084d2ad498ad1052196b62
Instruction ID: 9c97390e89d935f83254d209871e291db19b9c63286f40605fba36c4b88e3694
Opcode Fuzzy Hash: 67509b2d03e0cbdf339a13aa13b161fb11436c1d77084d2ad498ad1052196b62
Instruction Fuzzy Hash: FE51213021A686CBC714FF38E59599A77A7EB9520C340893DE0448F7AEDF789909CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00C605E0 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844409749.0000000000C60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c60000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd6c98b6239c0e15f4a54e6d2b60779c1cf4af31f225f95327423973500902d
Instruction ID: 582f2b353202682d51fab1ec331cc0c73798a7c6d0b723e6f8c17e4251df89c8
Opcode Fuzzy Hash: edd6c98b6239c0e15f4a54e6d2b60779c1cf4af31f225f95327423973500902d
Instruction Fuzzy Hash: 22018B755097805FD7128F159C41862FFF8EF86530709C4EFED498B652D225B809CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C60606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844409749.0000000000C60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c60000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0747f4b6de6644da22f535dbab057912906dc187a9e09dde36f690c485f0e11
Instruction ID: 96c73bab9bf80edca18f7abe1d616b2d8060832975e28f7c5133c279c623319c
Opcode Fuzzy Hash: e0747f4b6de6644da22f535dbab057912906dc187a9e09dde36f690c485f0e11
Instruction Fuzzy Hash: C2E092B66006048B9650DF0AEC41452F7D8EB88630708C47FDC0E8BB11E675B508CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C923F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844437175.0000000000C92000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c92000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1c62c1ecf58b0012a06aad5dd275011aea56c3dabf05da4c6417bb02e701d8
Instruction ID: 729f363e11d52ae464988baeaf6e73e13318180554af1eafe612747b696eed20
Opcode Fuzzy Hash: 7a1c62c1ecf58b0012a06aad5dd275011aea56c3dabf05da4c6417bb02e701d8
Instruction Fuzzy Hash: 30D02E792006C04FD7228A0CC2A8B8537D4AB60708F0A04F9A840CB763C728DA81E200

Uniqueness

Uniqueness Score: -1.00%

Function 00C923BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844437175.0000000000C92000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c92000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5a5a1aba23ed778780014232c5cf34f2b9b5e1a462a0efbd6383665981d2ce
Instruction ID: 6afe37245ee2386d3d5e17369a08d714eeb952e5a5126d56d38a824fb19bf741
Opcode Fuzzy Hash: ef5a5a1aba23ed778780014232c5cf34f2b9b5e1a462a0efbd6383665981d2ce
Instruction Fuzzy Hash: 9ED05E342002814FCB25DA0CC2D8F5937D8BB40714F1A44E8AC608B772C7A8D9C1DA00

Uniqueness

Uniqueness Score: -1.00%

Function 00DE006C Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1844648966.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_de0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e297e68b9010daa5b204279b64bb32f246a9ea1de209f5352f6bcbb0cbdaaca
Instruction ID: a0053d199cf8e71672acee6f4b10e0ec39ec45bc088add72a23c911fb86bcece
Opcode Fuzzy Hash: 5e297e68b9010daa5b204279b64bb32f246a9ea1de209f5352f6bcbb0cbdaaca
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NezbdhNgwG.exePID: 5228, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 015B0310 Relevance: 3.9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[\k^, xrefs: 015B0545, 015B054A
-[\k^, xrefs: 015B04DA, 015B04DF
=[\k^, xrefs: 015B0477, 015B047C

Memory Dump Source

Source File: 00000006.00000002.1928206112.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID: [\k^$-[\k^$=[\k^
API String ID: 0-4010822436
Opcode ID: 06490e1569f763d722e4b309c0ec87bfd9d051b6469effe1af650947b55a7fbc
Instruction ID: 1b523a5d48e26b33877b3438dc194e39595aee4ed04b6585481c51ba0d64ccf7
Opcode Fuzzy Hash: 06490e1569f763d722e4b309c0ec87bfd9d051b6469effe1af650947b55a7fbc
Instruction Fuzzy Hash: 1D51DF307102159BD728EB39A454ABE76E7FB85254B14447EE006DB3D4DF3ACC4A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 015B03BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[\k^, xrefs: 015B0545, 015B054A
-[\k^, xrefs: 015B04DA, 015B04DF
=[\k^, xrefs: 015B0477, 015B047C

Memory Dump Source

Source File: 00000006.00000002.1928206112.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID: [\k^$-[\k^$=[\k^
API String ID: 0-4010822436
Opcode ID: 0ea6903d6af32c4f8a4eb25b953720c96147516ca3286b864e18fb5f2fd7ad6f
Instruction ID: 3e7719e0007c28bcb573e1b686d9658e5fe25f58dd871d31f988f83981635647
Opcode Fuzzy Hash: 0ea6903d6af32c4f8a4eb25b953720c96147516ca3286b864e18fb5f2fd7ad6f
Instruction Fuzzy Hash: 5C4124307101159BCB28E779A1646BE76E7AFD5248B04447DE006DF7E4DF6ECC0A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 012EA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 012EA6B9

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b1edbf4b1650547378b91f8e01c3310c0c415b9454b658aca748ea39ad9c1264
Instruction ID: c027deb844c179ff73abbcb40c9b1e642ae7ebe9d747a68c64e583b973ab8cb2
Opcode Fuzzy Hash: b1edbf4b1650547378b91f8e01c3310c0c415b9454b658aca748ea39ad9c1264
Instruction Fuzzy Hash: C63181B55093806FE712CB25DC85B96BFF8EF06214F08849AE984CF292D365E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012EA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,07039CF7,00000000,00000000,00000000,00000000), ref: 012EA40C

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e23cebda820e689dfdc3319c8dda22c2f79a93e847d865bce9ae3bbe8225bd9f
Instruction ID: f2aaf842b3668f9ec0704b2abdbe6bda470d313404cad90ccd1f7ffdacf6ce08
Opcode Fuzzy Hash: e23cebda820e689dfdc3319c8dda22c2f79a93e847d865bce9ae3bbe8225bd9f
Instruction Fuzzy Hash: DC316175505740AFE722CF15CC88F96BFF8EF06614F08849AE985CB292D364E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 012EA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,07039CF7,00000000,00000000,00000000,00000000), ref: 012EA4F8

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ad1dfbf2b6d7bb10948eddf4b1ce6a1b20cc6becf14b4d1ca694e4989870f770
Instruction ID: 202c95ba8ecdafdc3e69b76918027b011ab640855212a64c79363c5e5c5fd465
Opcode Fuzzy Hash: ad1dfbf2b6d7bb10948eddf4b1ce6a1b20cc6becf14b4d1ca694e4989870f770
Instruction Fuzzy Hash: 4E2192765043806FE7228F15DC44FA7BFF8DF46614F08849AE989CB652D364E908C771

Uniqueness

Uniqueness Score: -1.00%

Function 012EA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 012EA6B9

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b9386f04cb5bfce99ea00b5aa521bed71b3d8bb3f9bdbb6f34570510319d8148
Instruction ID: ac0c898a3a09615a080cb131122f74e09b09eb172ee7a950029894fc1825aab2
Opcode Fuzzy Hash: b9386f04cb5bfce99ea00b5aa521bed71b3d8bb3f9bdbb6f34570510319d8148
Instruction Fuzzy Hash: 5C21C5716002009FEB20DF29CD85BA6FBE8EF15214F048469EE498B741D775E408CA71

Uniqueness

Uniqueness Score: -1.00%

Function 012EA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,07039CF7,00000000,00000000,00000000,00000000), ref: 012EA40C

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d2c8877efe8fcaab45bf91de3f4f58f790bf6826b0109fc70ca93edbaf4b2c3a
Instruction ID: 0dd5070cb9db26f84965ba89c2c2f3aaf15034d6caf5fb3922971e484aace25e
Opcode Fuzzy Hash: d2c8877efe8fcaab45bf91de3f4f58f790bf6826b0109fc70ca93edbaf4b2c3a
Instruction Fuzzy Hash: 5421AE75210200AFE720CF19CC89FA6B7ECEF04614F04C46AEA458B651D7A0E808CA72

Uniqueness

Uniqueness Score: -1.00%

Function 012EA710 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012EA780

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3dbe25653ce3548a891747ff427a840e27fb6c67cd4b0c1a03b267288c2859f5
Instruction ID: 041255a98f920bd7bc7fd02e64170c2f76d30b178cfec6b20cf9dae55f3a9835
Opcode Fuzzy Hash: 3dbe25653ce3548a891747ff427a840e27fb6c67cd4b0c1a03b267288c2859f5
Instruction Fuzzy Hash: 0D21C3B15093809FD7128F15DC85752BFB8EF06324F0984DBDD858F6A3D2749909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012EA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,07039CF7,00000000,00000000,00000000,00000000), ref: 012EA4F8

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 532146432c755f1a4a27dec084d690408dc63dde8f8d8e3d0b5dced3808c9fa0
Instruction ID: abf1d7de0891c446d5bf4de9dca95d9cee709a387ea534e8e7e6bc8881755d37
Opcode Fuzzy Hash: 532146432c755f1a4a27dec084d690408dc63dde8f8d8e3d0b5dced3808c9fa0
Instruction Fuzzy Hash: 50119376610600AFE7218F15DC89FA7FBECEF14714F04845AEE498B651D774E508CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 012EA74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012EA780

Memory Dump Source

Source File: 00000006.00000002.1927946511.00000000012EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12ea000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c1f22e28ce351d30aa70cb9638bdb900052dc4a87e39d05429678a4e41139671
Instruction ID: 8288d90d66216715d73dba806c019a60c1d815ed4fd969ba37168425bd6c034a
Opcode Fuzzy Hash: c1f22e28ce351d30aa70cb9638bdb900052dc4a87e39d05429678a4e41139671
Instruction Fuzzy Hash: FD0184756502409FEB10CF19D989765FBE4DF04620F08C4ABDD4A8F756D675E404CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 015B0080 Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1928206112.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe99fa783c5f0619a32c26c9024833b28d268e64bf9ba1462d51d32eeb9fe42e
Instruction ID: 27805c52ce960888079600f6cc7dc41e165502770d22c6cf3e5e2b0e76f28af8
Opcode Fuzzy Hash: fe99fa783c5f0619a32c26c9024833b28d268e64bf9ba1462d51d32eeb9fe42e
Instruction Fuzzy Hash: F9513F30611286AFC734DB3AF694D9A77A2FB81208740897DD014CB669DF3D9DADCB81

Uniqueness

Uniqueness Score: -1.00%

Function 015B0006 Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1928206112.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9ebad2d0f7f2b82ecbce6cc7b5acc2fb7588acf0eba03cd3486c4ec61a1b01
Instruction ID: 307b3955dd6426ab88cce29647e0ec889fe92e0ffb6fa76ed36c905827e35932
Opcode Fuzzy Hash: 3c9ebad2d0f7f2b82ecbce6cc7b5acc2fb7588acf0eba03cd3486c4ec61a1b01
Instruction Fuzzy Hash: 0601212508E3C28FC7439B7458A14907FB0AE5322476F41DBC880CE5A7E22E199EE773

Uniqueness

Uniqueness Score: -1.00%

Function 014C05DF Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1928160049.00000000014C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae122a4662b3ceda6b77b7129888b36319b51d39be5af732038da7f855528b7a
Instruction ID: b6b59c9f8116d39659cefc87b0e134a4b3af9d261b89cc286ae13f16179f8f7d
Opcode Fuzzy Hash: ae122a4662b3ceda6b77b7129888b36319b51d39be5af732038da7f855528b7a
Instruction Fuzzy Hash: 4C01D6B654D3806FD7128B16AC41862FFF8DB8663070984EFEC498B652D265B809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 014C0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1928160049.00000000014C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_14c0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181b53a26acefedf82a963460bae94aa9ab6e96461ad27c2d8a76fc9aa8b5f43
Instruction ID: c09790cc0b2b136efab7bd53a6c40e0d0d35187d7ccfb11bfd543d293a2c39e7
Opcode Fuzzy Hash: 181b53a26acefedf82a963460bae94aa9ab6e96461ad27c2d8a76fc9aa8b5f43
Instruction Fuzzy Hash: 16E092B66006004B9650CF0AED81462F7D8EB84630B08C47FDC0D8B701D675B508CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012E23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1927934795.00000000012E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12e2000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b345480a82840a89b286c1e2f21dd6c21b84b614bd00d5e0fbb306d3877593a6
Instruction ID: a7655bf6380ade3fe30ca4f0da2e6c5a9f5f4fa2e251db1e8e4de67f101a21d0
Opcode Fuzzy Hash: b345480a82840a89b286c1e2f21dd6c21b84b614bd00d5e0fbb306d3877593a6
Instruction Fuzzy Hash: E7D02E792106E28FE3228B0CC2A8B853BE8AB40704F8A04F9A800CB763C728D481C210

Uniqueness

Uniqueness Score: -1.00%

Function 012E23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1927934795.00000000012E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_12e2000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776114d7b8ee7713c7d21280d7cef3fc502d080e2fc9e438dd72bf90994dbab5
Instruction ID: 4907709b04e21582e7e9c5c4f6648d4582e2153509aa93b6b64a368ffa2235c5
Opcode Fuzzy Hash: 776114d7b8ee7713c7d21280d7cef3fc502d080e2fc9e438dd72bf90994dbab5
Instruction Fuzzy Hash: E9D05E342002828FD725DB0CC2D8F593BD8AB41714F2A44E8BD118B762C7A4D8C1DE00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NezbdhNgwG.exePID: 3748, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04980310 Relevance: 3.9, Strings: 3, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-[k^, xrefs: 049804DA, 049804DF
=[k^, xrefs: 04980477, 0498047C
[k^, xrefs: 04980545, 0498054A

Memory Dump Source

Source File: 00000009.00000002.2009201058.0000000004980000.00000040.00000800.00020000.00000000.sdmp, Offset: 04980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4980000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID: [k^$-[k^$=[k^
API String ID: 0-3244988689
Opcode ID: 6176876922556d228979c1f4b0199c2f044c4acbd985e6738d302ffa6e8666a0
Instruction ID: 69f4472d2a43c8d44ac872120648522c7fc4bb3254ac8b77533390f85e89c3ea
Opcode Fuzzy Hash: 6176876922556d228979c1f4b0199c2f044c4acbd985e6738d302ffa6e8666a0
Instruction Fuzzy Hash: D451FF317002048BCB18BB799411ABE37E7AB85204B55857DE006CB3E6DFBDDD0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 049803BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-[k^, xrefs: 049804DA, 049804DF
=[k^, xrefs: 04980477, 0498047C
[k^, xrefs: 04980545, 0498054A

Memory Dump Source

Source File: 00000009.00000002.2009201058.0000000004980000.00000040.00000800.00020000.00000000.sdmp, Offset: 04980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4980000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID: [k^$-[k^$=[k^
API String ID: 0-3244988689
Opcode ID: 02ae12bcc36a294c9d97c610c0b6956024d55e60a0164189cfa74f36ebb22e4f
Instruction ID: e920110e7dcd8cabc46ad05df9b291f821dd439de6f27402e0aaa634b51a4792
Opcode Fuzzy Hash: 02ae12bcc36a294c9d97c610c0b6956024d55e60a0164189cfa74f36ebb22e4f
Instruction Fuzzy Hash: CB41F131B002148BCB28B77D94116BE32D79FC5249745857DE006DB7E6EFAECD0A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00AAA6B9

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e717149bb4f95d2052b5646c9c60d9e3d6e0341f633871b551fcc04bd10cc18f
Instruction ID: 26304e440bd27fa80c9b99d7dd9f7241c072717110921e61689dafa65942fbbe
Opcode Fuzzy Hash: e717149bb4f95d2052b5646c9c60d9e3d6e0341f633871b551fcc04bd10cc18f
Instruction Fuzzy Hash: 603181755093806FE712CB25DC85B96BFF8EF16310F08849AE984CB292D375E909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3940E25D,00000000,00000000,00000000,00000000), ref: 00AAA40C

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e0864b2526417f30e65907f06151370b92402013eeb5ceb0f0165c77f8df397f
Instruction ID: c89dc6f8d24a260d5758cf1f66e64bfcf77e967c81e77789abfd3c8559b8df10
Opcode Fuzzy Hash: e0864b2526417f30e65907f06151370b92402013eeb5ceb0f0165c77f8df397f
Instruction Fuzzy Hash: 88316F75505780AFE722CF11CC84F92BBF8EF16714F08849AE985CB292D364E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3940E25D,00000000,00000000,00000000,00000000), ref: 00AAA4F8

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a9720745b6ff9e1abad6d1a8cb38d63fef1172a9693850da4ee2f33ba18c6867
Instruction ID: 2199372ebc75e6afe61801972079ccfb64217ac027b16d8a0f0a871cbb23a074
Opcode Fuzzy Hash: a9720745b6ff9e1abad6d1a8cb38d63fef1172a9693850da4ee2f33ba18c6867
Instruction Fuzzy Hash: 9C2192765043806FD7228F11DC44FA7BFF8DF56214F08849AE985CB692D364E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00AAA6B9

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e33fb95525827e1061b66c4846d3d4d76785d6f2ba41a3b28553431b934092bc
Instruction ID: 9a115f3bf455f5785a925de5034c55a3397d399d680949ecb866489979762fec
Opcode Fuzzy Hash: e33fb95525827e1061b66c4846d3d4d76785d6f2ba41a3b28553431b934092bc
Instruction Fuzzy Hash: 43218071600200AFE720DB25DD85BA6FBE8EF15314F08886AE948CB781D775E909CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3940E25D,00000000,00000000,00000000,00000000), ref: 00AAA40C

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 17df98810f4d7682d75a1dca31903c7f0f979df84806c2e248bbea868fb6b978
Instruction ID: 7a9dc39098c3f70868ab14108e011b3d53fec1d6f61697f9abde25769280c1c2
Opcode Fuzzy Hash: 17df98810f4d7682d75a1dca31903c7f0f979df84806c2e248bbea868fb6b978
Instruction Fuzzy Hash: 42215E75600604AFEB20CF15CC84FA6F7ECEF29714F14846AE9498B691D764E909CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA710 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00AAA780

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 276f5bf014011f6be6ec5b7fcbe8713c222733d3aa8aa061f56844dc64f7aa6a
Instruction ID: 3d3d34c2bdb7353ec62f2518033d90afca9fb748265da364c6d4f0adf1b0aab9
Opcode Fuzzy Hash: 276f5bf014011f6be6ec5b7fcbe8713c222733d3aa8aa061f56844dc64f7aa6a
Instruction Fuzzy Hash: 2221A1B15093809FD7128F15DC85752BFB8EF13324F0984DBD9858B6A3D3349909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3940E25D,00000000,00000000,00000000,00000000), ref: 00AAA4F8

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8874b818ec68ff398bded5beb8e3e5acba4f0c7719b59a51c0680260cf5272e2
Instruction ID: 09b53da7f75a5ba2d40594f058c8944373ffc5cc500f1a770cf3b248d2c44e92
Opcode Fuzzy Hash: 8874b818ec68ff398bded5beb8e3e5acba4f0c7719b59a51c0680260cf5272e2
Instruction Fuzzy Hash: 0A11B176600600AFE7218F15CC44FA7FBECEF29714F04846AED498B681D370E808CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00AAA780

Memory Dump Source

Source File: 00000009.00000002.2008734054.0000000000AAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aaa000_NezbdhNgwG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6fa5cc33b4ad08946b91f7fc3bb1c9530b393719fcb80f3fbfa6065781aae612
Instruction ID: 3cd19521fb6adc25be5f02afb924ad9ca07c5009af1a33b2d8ed7cad616a7f68
Opcode Fuzzy Hash: 6fa5cc33b4ad08946b91f7fc3bb1c9530b393719fcb80f3fbfa6065781aae612
Instruction Fuzzy Hash: 23017C756002409FEB108F19D985766FBE4DF55720F08C4AADD49CB796D379E808CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 04980080 Relevance: .1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2009201058.0000000004980000.00000040.00000800.00020000.00000000.sdmp, Offset: 04980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4980000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06475a931027b2e058150fea4e64891ab0dd57147b23fb3b1244118632911b09
Instruction ID: 1feb481c0f8102c93eaeb73d291efb464f3f0b799105de80be406487c0c865d0
Opcode Fuzzy Hash: 06475a931027b2e058150fea4e64891ab0dd57147b23fb3b1244118632911b09
Instruction Fuzzy Hash: 49513831616349CBCB18FB78E55494A77A2AF95209340C97DD0058B7AFDFBC5909CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00CF05E0 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2008940748.0000000000CF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cf0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14091a018581a9b123a27beb7ef421e4b4a6c2b42bea58749b5965b876d71bc4
Instruction ID: d23d4dadacf53bfbfb3dfe964dc8b66e6b266989083a201656e78744570d42f3
Opcode Fuzzy Hash: 14091a018581a9b123a27beb7ef421e4b4a6c2b42bea58749b5965b876d71bc4
Instruction Fuzzy Hash: E60186765097806FD7128F05AC51863FFB8EF86630709C4EFEC498B752D229A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 04980006 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2009201058.0000000004980000.00000040.00000800.00020000.00000000.sdmp, Offset: 04980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4980000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798da3e3b453da3f6ebcf45da96612db5a52072d0017953cd9b7899fb5c152b8
Instruction ID: a740b123bf557b24c2781bdeb172fe2d80aecf5b6ac24a6daa9dfe4e13b6e508
Opcode Fuzzy Hash: 798da3e3b453da3f6ebcf45da96612db5a52072d0017953cd9b7899fb5c152b8
Instruction Fuzzy Hash: 4801E99248F7C55FE70383752C799913FB09E4301979F80EBC991CB4ABA44E5A0AA723

Uniqueness

Uniqueness Score: -1.00%

Function 00CF0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2008940748.0000000000CF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cf0000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8859686b21d1096aab29136a7fc154bbf676f12ca69a89d4d594a6850bd3c55
Instruction ID: 3f2484f16fbb724e52b7faa95e2c63bbffebdb434ae9ca954e941c3a191f8f14
Opcode Fuzzy Hash: e8859686b21d1096aab29136a7fc154bbf676f12ca69a89d4d594a6850bd3c55
Instruction Fuzzy Hash: 7DE092B66006004B9650DF0AED41452F7D8EB84630718C47FDC0D8B701D235B508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2008717989.0000000000AA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa2000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c60ad43a1d613c472a67a5500010ee32d7b31362d9db92792a29498e38b4a99
Instruction ID: f2f860c730edf43de570d8db8d90447c1261fbb1491480dc1a8d79b9ab491db2
Opcode Fuzzy Hash: 3c60ad43a1d613c472a67a5500010ee32d7b31362d9db92792a29498e38b4a99
Instruction Fuzzy Hash: ACD02E792407C04FD3268B0CC2A4B8537D4AB46704F0A04F9A800CB7A3C728D881C200

Uniqueness

Uniqueness Score: -1.00%

Function 00AA23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2008717989.0000000000AA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa2000_NezbdhNgwG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38c8fec3b4bcb35fa91a9c5649eb14fbb8a84db398d978d3f8cc0b2aa342be1
Instruction ID: 3103e871ff415faae3901a2a4ab56bf2af5d3a5cbcd0acb920613a7381d39a2f
Opcode Fuzzy Hash: f38c8fec3b4bcb35fa91a9c5649eb14fbb8a84db398d978d3f8cc0b2aa342be1
Instruction Fuzzy Hash: 1FD05E342002814FDB25DB0CC2D4F5937D4AB42714F1A48E9AC108F7A2C7A8D8D1DA10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NezbdhNgwG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\NezbdhNgwG.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8c3a19ded61c2fe03bf66a3900261406.exe:Zone.Identifier

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
NezbdhNgwG.exe

Function 00A30F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 00A30F80 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00BC1C32 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00BC2C1A Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Function 00BC0D77 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 00BC19A4 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0060AA52 Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Function 0060A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 00BC1290 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 0060ADAD Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Function 00BC2C46 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON