Edit tour

Windows Analysis Report
WtRLqa6ZXn.exe

Overview

General Information

Sample Name:	WtRLqa6ZXn.exe
Original Sample Name:	de237777518dc9c0b7a03c536746d878.exe
Analysis ID:	1348052
MD5:	de237777518dc9c0b7a03c536746d878
SHA1:	a357466573e35d634a119b7f2e7a8a18f5018811
SHA256:	23c6e8163646ba03c0a5c6dcdf0f0df5688ec4a91c8bd9b663888440254bc12f
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Machine Learning detection for sample

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

WtRLqa6ZXn.exe (PID: 6444 cmdline: C:\Users\user\Desktop\WtRLqa6ZXn.exe MD5: DE237777518DC9C0B7A03C536746D878)

cleanup

Snort Signatures

ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC - Source IP: 192.168.2.6 - Destination IP: 185.158.115.191

Timestamp:	192.168.2.6185.158.115.1914970910012806881 11/26/23-18:54:06.452721
SID:	2806881
Source Port:	49709
Destination Port:	1001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC - Source IP: 192.168.2.6 - Destination IP: 185.158.115.191

Timestamp:	192.168.2.6185.158.115.1915029010022806881 11/26/23-18:56:07.142932
SID:	2806881
Source Port:	50290
Destination Port:	1002
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: WtRLqa6ZXn.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: WtRLqa6ZXn.exe	ReversingLabs: Detection: 70%
Source: WtRLqa6ZXn.exe	Virustotal: Detection: 74%			Perma Link

Machine Learning detection for sample

Source: WtRLqa6ZXn.exe

Joe Sandbox ML: detected

Source: WtRLqa6ZXn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WtRLqa6ZXn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Code function: 0_2_00841300 GetWindowsDirectoryA,FindFirstFileA,FindClose,

0_2_00841300

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2806881 ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC 192.168.2.6:49709 -> 185.158.115.191:1001
Source: Traffic	Snort IDS: 2806881 ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC 192.168.2.6:50290 -> 185.158.115.191:1002

Source: Joe Sandbox View

IP Address: 67.195.228.94 67.195.228.94

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Code function: 0_2_00841490 StrStrIA,recv,StrStrIA,

0_2_00841490

Source: WtRLqa6ZXn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WtRLqa6ZXn.exe	ReversingLabs: Detection: 70%
Source: WtRLqa6ZXn.exe	Virustotal: Detection: 74%

Source: WtRLqa6ZXn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal68.winEXE@1/0@0/33

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\IpbudbiLjohb

Source: WtRLqa6ZXn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-805

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe TID: 2036

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Code function: 0_2_00841300 GetWindowsDirectoryA,FindFirstFileA,FindClose,

0_2_00841300

Source: WtRLqa6ZXn.exe, 00000000.00000002.3396213563.00000000014EE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Code function: 0_2_00841540 CreateEventW,CreateThread,CloseHandle,lstrcmpiA,Sleep,Sleep,Sleep,Sleep,setsockopt,closesocket,GetProcessHeap,HeapAlloc,CreateThread,FindCloseChangeNotification,GetProcessHeap,HeapFree,SetEvent,

0_2_00841540

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\WtRLqa6ZXn.exe

Code function: 0_2_00841360 GetTempPathA,GetVolumeInformationA,GetComputerNameA,GetUserNameA,

0_2_00841360

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	21 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WtRLqa6ZXn.exe	70%	ReversingLabs	Win32.Trojan.MintMurphy
WtRLqa6ZXn.exe	75%	Virustotal		Browse
WtRLqa6ZXn.exe	100%	Avira	TR/Crypt.XPACK.Gen
WtRLqa6ZXn.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.69.139.60	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
212.227.17.178	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
195.54.174.27	unknown	unknown	199236	EMARSYS-ASEmarsyseMarketingSystemsAGAT	false
67.195.228.94	unknown	United States	36647	YAHOO-GQ1US	false
93.186.225.205	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
142.251.111.109	unknown	United States	15169	GOOGLEUS	false
95.181.181.87	unknown	Russian Federation	61120	AIRNETRU	false
87.240.139.193	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
143.90.14.136	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
149.154.167.99	unknown	United Kingdom	62041	TELEGRAMRU	false
52.96.48.54	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.167.108	unknown	United States	15169	GOOGLEUS	false
62.173.147.3	unknown	Russian Federation	34300	SPACENET-ASInternetServiceProviderRU	false
178.248.235.219	unknown	Russian Federation	197068	QRATORRU	false
37.1.217.172	unknown	Ukraine	58061	SCALAXY-ASNL	false
44.241.129.35	unknown	United States	16509	AMAZON-02US	false
52.40.178.147	unknown	United States	16509	AMAZON-02US	false
81.19.78.89	unknown	Russian Federation	24638	RAMBLER-TELECOM-ASRU	false
81.19.78.87	unknown	Russian Federation	24638	RAMBLER-TELECOM-ASRU	false
87.248.103.8	unknown	United Kingdom	34010	YAHOO-IRDGB	false
212.227.17.162	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
92.53.64.209	unknown	Russian Federation	49505	SELECTELRU	false
94.100.184.66	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
185.158.115.191	unknown	Russian Federation	44812	IPSERVER-RU-NETFiordRU	true
52.96.88.34	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
195.49.132.16	unknown	France	57633	TERANET2FR	false
142.251.16.109	unknown	United States	15169	GOOGLEUS	false
67.195.176.152	unknown	United States	26101	YAHOO-3US	false
213.59.254.8	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
178.248.238.27	unknown	Russian Federation	197068	QRATORRU	false
91.206.14.139	unknown	Russian Federation	49505	SELECTELRU	false
104.127.87.210	unknown	United States	20940	AKAMAI-ASN1EU	false
52.96.32.178	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1348052
Start date and time:	2023-11-26 18:53:12 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	WtRLqa6ZXn.exe renamed because original name is a hash value
Original Sample Name:	de237777518dc9c0b7a03c536746d878.exe
Detection:	MAL
Classification:	mal68.winEXE@1/0@0/33
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.113.194.133, 52.178.182.128, 52.158.121.3, 20.190.151.7, 20.190.151.69, 20.190.151.67, 20.190.151.134, 20.190.151.8, 20.190.151.131, 20.190.151.68, 20.190.151.132, 104.16.120.50, 104.16.119.50, 17.32.194.38, 17.32.194.7, 172.253.122.95, 192.168.2.6
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, ajax.googleapis.com, www.tm.v4.a.prd.aadg.akadns.net, go-skype-com.s-0006.s-msedge.net, ctldl.windowsupdate.com, login.skype-apps.akadns.net, login.msa.msidentity.com, idmsa.idms-apple.com.akadns.net, fe3cr.delivery.mp.microsoft.com, idmsa.apple.com, secure.skype-apps.akadns.net, ocsp.digicert.com, login.live.com, auth.riotgames.com.cdn.cloudflare.net, s-0006.s-msedge.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtDeviceIoControlFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
217.69.139.60	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse
67.195.228.94	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	doc.msg.exe	Get hash	malicious	Unknown	Browse
	b7413f528510f6f00fe90877e39b3cb1b94fbfb4974fe.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	IKUiRXwsnT.exe	Get hash	malicious	Tofsee Xmrig	Browse
	Update-KB3756-x86.exe	Get hash	malicious	Unknown	Browse
	sbFQSOHQS9.exe	Get hash	malicious	Tofsee Xmrig	Browse
	g5keI4ykVe.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	X54kf4zSf8.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	Xu7v9n5LLd.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
	Player.apk	Get hash	malicious	Unknown	Browse
	bLPTjx97o4.exe	Get hash	malicious	Tofsee Xmrig	Browse
	UzvE3ZF7RC.exe	Get hash	malicious	Tofsee Xmrig	Browse
	sKu7FoPlk3.exe	Get hash	malicious	Unknown	Browse
	sample1-unpacked.exe	Get hash	malicious	MyDoom	Browse
93.186.225.205	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse
95.181.181.87	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	178.237.22.112
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	http://skladtandem.ru/bitrix/admin/mrt/redirect.php?login=tendai@transafricamedicals.co.za&source=gmail&ust=1691478366880000&usg=AOvVaw3Yg-fX-mtHN-vCYoBB8D5Q	Get hash	malicious	Unknown	Browse	95.163.251.206
	8zb8fo2h7Z.elf	Get hash	malicious	Mirai	Browse	178.237.22.122
	Eypxe2gysn.elf	Get hash	malicious	Mirai	Browse	178.237.22.116
	http://top.mail.ru	Get hash	malicious	HTMLPhisher	Browse	217.69.139.59
	c97231396401b664fb865042a75fb600f6a752b2667bb8ef2d662fb0.exe	Get hash	malicious	Unknown	Browse	217.20.147.1
	c97231396401b664fb865042a75fb600f6a752b2667bb8ef2d662fb0.exe	Get hash	malicious	Unknown	Browse	5.61.23.11
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	https://mlattach.datacloudmail.ru/loader2/FE43D946C5A5F4AF6EF27A93FF7D7BE634577DE6?attach_id=QElpz4z3XEA1QN0c&expires=1697043293&from=e.mail.ru&m=ObkvJVHVmfz4nZdtQ4IkgQ&x-email=matthewblock%40eversheds-sutherlandll.com	Get hash	malicious	HTMLPhisher	Browse	5.61.236.128
	https://checklink.mail.ru/proxy?es=sel%2B0385qeoJtN2ktpDPP1cKO1E%2BjLj9lZzWEU3b1Y4%3D&egid=WV%2B9%2BE9MBUW6kIM%2BcYO78LeXgANMoBnZPz6k56%2BGDpU%3D&url=https%3A%2F%2Fclick.mail.ru%2Fredir%3Fu%3Dhttps%253A%252F%252Fwebmail.swan.co.th%252Fcompose%253FTo%253DMatthewblock%2540eversheds%25252dsutherlandll.com%26c%3Dswm%26r%3Dhttp%26o%3Dmail%26v%3D3%26s%3D9c23e2fe93a31d67&uidl=16969566711024638549&from=ipad%40office-dsk.com&to=ipad%40office-dsk.com&email=ipad%40office-dsk.com	Get hash	malicious	HTMLPhisher	Browse	5.181.61.0
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	jklarm-20231011-2200.elf	Get hash	malicious	Mirai	Browse	128.140.169.84
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	217.69.134.45
	https://ok.me/jfjC1#qsv17j9	Get hash	malicious	HTMLPhisher	Browse	217.20.155.6
	x86.elf	Get hash	malicious	Unknown	Browse	128.140.169.90
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	94.100.180.60
	5LW1482x87.elf	Get hash	malicious	Mirai	Browse	94.100.184.227
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
EMARSYS-ASEmarsyseMarketingSystemsAGAT	baR0qbxuDh.elf	Get hash	malicious	Mirai	Browse	217.175.199.14
EMARSYS-ASEmarsyseMarketingSystemsAGAT	https://clicktrack.tulli.ro/u/gm.php?prm=SCKffwYflp_522422937_8354056_8420	Get hash	malicious	Unknown	Browse	217.175.192.11
ONEANDONE-ASBrauerstrasse48DE	gunzipped.exe	Get hash	malicious	FormBook	Browse	74.208.236.243
	klWGq3yDcQ.exe	Get hash	malicious	Unknown	Browse	74.208.5.3
	klWGq3yDcQ.exe	Get hash	malicious	Unknown	Browse	198.71.53.137
	file.exe	Get hash	malicious	Unknown	Browse	217.160.255.217
	rDHLReceipt_8939977153.exe	Get hash	malicious	FormBook	Browse	217.160.0.118
	QUOTATION#67353-15-2023.exe	Get hash	malicious	FormBook, NSISDropper	Browse	74.208.236.78
	PI-_8945001-10-11-2023.exe	Get hash	malicious	FormBook, NSISDropper	Browse	74.208.236.78
	yWVLQIrdCC.elf	Get hash	malicious	Mirai	Browse	195.20.246.125
	BEM00263.docx	Get hash	malicious	FormBook	Browse	217.160.0.131
	DHL_Receipt_#893915078.exe	Get hash	malicious	FormBook	Browse	217.160.0.118
	Qte2311.exe	Get hash	malicious	FormBook	Browse	217.160.0.131
	1.exe	Get hash	malicious	FormBook	Browse	217.160.0.167
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	74.208.215.145
	009c487a.exe	Get hash	malicious	FormBook	Browse	217.160.0.131
	S00989282313413.exe	Get hash	malicious	FormBook	Browse	74.208.239.72
	Maersk_K22TSI714881.exe	Get hash	malicious	FormBook	Browse	217.160.0.118
	S00989282313413.exe	Get hash	malicious	FormBook	Browse	74.208.239.72
	S00989282313413.exe	Get hash	malicious	FormBook	Browse	74.208.239.72
	S00989282313413.exe	Get hash	malicious	FormBook	Browse	74.208.239.72
	S00989282313413.exe	Get hash	malicious	FormBook	Browse	74.208.239.72

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.220436500559913
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WtRLqa6ZXn.exe
File size:	63'824 bytes
MD5:	de237777518dc9c0b7a03c536746d878
SHA1:	a357466573e35d634a119b7f2e7a8a18f5018811
SHA256:	23c6e8163646ba03c0a5c6dcdf0f0df5688ec4a91c8bd9b663888440254bc12f
SHA512:	40337a848a49487805dbb663313de888c967cb4392fe1c63311395a005b22633f603c8868d2bfbc05539844926072c80cd9dd4abfcb0786098e8e3e242d12067
SSDEEP:	1536:2mLuy2AtwhCC3P43iyGS5lzYAfQzf/3ma9cS3:2qJzC3Ki5ylUA4zf/3mocC
TLSH:	0853F105E4526CCDEBF68275A6650489E134CB524B033CE323E13DBA1D4EEC9A1B7626
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p'..4F..4F..4F...I..6F...1..9F..4F...F......6F..R...5F..R...5F..R...5F..Rich4F..........................PE..L...+.We...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401020
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6557E72B [Fri Nov 17 22:20:27 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f9e0f22dd6f41da7f3579c559466fbd0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
call 00007F874089250Dh
push FFFFFFFFh
call dword ptr [00403038h]
mov eax, 00000001h
pop ebp
retn 0010h
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 20h
mov dword ptr [ebp-14h], 00000000h
mov dword ptr [ebp-20h], 0040313Ch
mov dword ptr [ebp-1Ch], 00403148h
mov dword ptr [ebp-18h], 00403154h
mov dword ptr [ebp-04h], 00000000h
jmp 00007F8740891B2Bh
mov eax, dword ptr [ebp-04h]
add eax, 01h
mov dword ptr [ebp-04h], eax
cmp dword ptr [ebp-04h], 03h
jnc 00007F8740891B90h
mov dword ptr [ebp-08h], FFFFFFFFh
mov dword ptr [ebp-0Ch], 00000000h
jmp 00007F8740891B2Bh
mov ecx, dword ptr [ebp-0Ch]
add ecx, 01h
mov dword ptr [ebp-0Ch], ecx
cmp dword ptr [ebp-0Ch], 03h
jnl 00007F8740891B3Fh
mov edx, dword ptr [ebp-04h]
mov eax, dword ptr [ebp+edx*4-20h]
push eax
call 00007F874089269Fh
add esp, 04h
mov dword ptr [ebp-08h], eax
cmp dword ptr [ebp-08h], FFFFFFFFh
je 00007F8740891B24h
jmp 00007F8740891B24h
jmp 00007F8740891AF6h
cmp dword ptr [ebp-08h], FFFFFFFFh
je 00007F8740891B4Ch
push 00000019h
mov ecx, dword ptr [ebp-08h]
push ecx
call 00007F8740891BCEh
add esp, 08h
mov dword ptr [ebp-10h], eax
cmp dword ptr [ebp-10h], FFFFFFFFh
je 00007F8740891B35h
mov edx, dword ptr [ebp-10h]
push edx
call dword ptr [004030ACh]
mov dword ptr [ebp-14h], 00000001h
jmp 00007F8740891B24h
jmp 00007F8740891AA5h

Rich Headers

Programming Language:

[EXP] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x37a0	0x49	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3414	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0x1d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3000	0xc4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1fe0	0x2000	False	0.525390625	data	5.955345217509494	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3000	0x7e9	0x800	False	0.4580078125	data	5.233547677908448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4000	0xa8	0x200	False	0.033203125	DOS executable (block device driver)	0.06591441234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5000	0x1e0	0x200	False	0.525390625	data	4.696122618599126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0x44a	0x600	False	0.30859375	data	2.7348987790512544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x5060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	socket, setsockopt, send, select, gethostbyname, WSAStartup, recv, inet_addr, connect, htons, closesocket
DNSAPI.dll	DnsQuery_A, DnsFree
KERNEL32.dll	GetComputerNameA, InterlockedExchange, GetTempPathA, lstrlenA, lstrcatA, lstrcpyA, GetWindowsDirectoryA, GetVolumeInformationA, SetEvent, Sleep, CreateThread, FindClose, FindFirstFileA, CloseHandle, GetLastError, HeapAlloc, HeapFree, GetProcessHeap, CreateEventW, WaitForSingleObject, CreateMutexA, lstrcmpiA
USER32.dll	wsprintfA
ADVAPI32.dll	GetUserNameA
ntdll.dll	memcpy, memcmp, _chkstk
SHLWAPI.dll	StrToIntA, StrStrIA

Exports

Name	Ordinal	Address
DllEntry	1	0x401000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	18:54:04
Start date:	26/11/2023
Path:	C:\Users\user\Desktop\WtRLqa6ZXn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WtRLqa6ZXn.exe
Imagebase:	0x840000
File size:	63'824 bytes
MD5 hash:	DE237777518DC9C0B7A03C536746D878
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	45.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16%
Total number of Nodes:	244
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00841540 Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 327
memorysleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00841360: GetTempPathA.KERNEL32(00000105,?), ref: 0084137C
Part of subcall function 00841360: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008413B1
Part of subcall function 00841360: GetComputerNameA.KERNEL32(00000000,00000105), ref: 008413D8
Part of subcall function 00841360: GetUserNameA.ADVAPI32(00000000,00000105), ref: 00841427

Part of subcall function 00841300: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0084131C
Part of subcall function 00841300: FindFirstFileA.KERNELBASE(?,?), ref: 00841334
Part of subcall function 00841300: FindClose.KERNEL32(000000FF), ref: 00841347

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0084159C
CreateThread.KERNELBASE(00000000,00000000,00841D60,00000000,00000000,00000000), ref: 008415C3
CloseHandle.KERNEL32(00000000), ref: 008415DA
lstrcmpiA.KERNEL32(00844028,00844068), ref: 00841607
Sleep.KERNEL32(00002710), ref: 00841647

Part of subcall function 00841BC0: inet_addr.WS2_32(00841686), ref: 00841BD1
Part of subcall function 00841BC0: gethostbyname.WS2_32(00841686), ref: 00841BE4

Sleep.KERNEL32(00002710), ref: 00841699
Sleep.KERNEL32(00001388), ref: 008416D2
Sleep.KERNEL32(00001388), ref: 00841733
setsockopt.WS2_32(?,0000FFFF,00001006,0001D4C0,00000004), ref: 00841759
closesocket.WS2_32(?), ref: 0084182F
GetProcessHeap.KERNEL32(00000000,0000001C), ref: 00841865
HeapAlloc.KERNEL32(00000000), ref: 0084186C
CreateThread.KERNELBASE(00000000,00000000,008421D0,00000000,00000000,00000000), ref: 008418F2
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00841905
SetEvent.KERNEL32(?), ref: 008419D8

Part of subcall function 00841CD0: send.WS2_32(00000000,00000000,0000001A,00000000), ref: 00841D03

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00841925
HeapFree.KERNEL32(00000000), ref: 0084192C

Strings

x, xrefs: 008419A3
x, xrefs: 0084199D

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: HeapSleep$CloseCreateFind$EventNameProcessThread$AllocChangeComputerDirectoryFileFirstFreeHandleInformationNotificationPathTempUserVolumeWindowsclosesocketgethostbynameinet_addrlstrcmpisendsetsockopt
String ID: x$x
API String ID: 2795221928-177600594
Opcode ID: 8fbe15bce8e0697200c27b32b11417c7f5f26f59bc295924b9144af508956366
Instruction ID: 9f532ecf4bdda7a65825dc6805a779b78b0380fff9a83fe61aa9c3ec4570d1f1
Opcode Fuzzy Hash: 8fbe15bce8e0697200c27b32b11417c7f5f26f59bc295924b9144af508956366
Instruction Fuzzy Hash: 7AD1AC78E0060CEBDF24CFA4E849BADBB70FB45305F144229E612E7391E7789A95CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00841490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.SHLWAPI(00000000,), ref: 008414A6
recv.WS2_32(00000000,?,FFFFFFFF,00000000), ref: 008414E2

Strings

, xrefs: 0084149D
, xrefs: 0084150B

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recv
String ID: $
API String ID: 1507349165-3624791563
Opcode ID: f5a40738f81c2b0b877e08161b1dc4c3ff7e26215a1867e51de19bc6bd643ff7
Instruction ID: 9440d01336115c854d0b05430bccd3178ddbf03fc1a91f4cbbbfa332689daa98
Opcode Fuzzy Hash: f5a40738f81c2b0b877e08161b1dc4c3ff7e26215a1867e51de19bc6bd643ff7
Instruction Fuzzy Hash: 6711C375A0424CEBDF04DFA8D948BAEBBB5FB89304F208599A816D7380D774DA80DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00841360 Relevance: 6.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000105,?), ref: 0084137C
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008413B1
GetComputerNameA.KERNEL32(00000000,00000105), ref: 008413D8
GetUserNameA.ADVAPI32(00000000,00000105), ref: 00841427

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: Name$ComputerInformationPathTempUserVolume
String ID:
API String ID: 3941947965-0
Opcode ID: 46a41bd1a72dbd95f71f1e6ce9a026230bc4d7f5553a8e2d3a906d52331a7578
Instruction ID: 646d10104c710428607307816a708f8ceb0cc35464663b683326a05693d5b568
Opcode Fuzzy Hash: 46a41bd1a72dbd95f71f1e6ce9a026230bc4d7f5553a8e2d3a906d52331a7578
Instruction Fuzzy Hash: 3E310A70A0021DEBDF18CF90C949BEDBBB9FB41705F208199D615AA280EB759B84DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00841300 Relevance: 4.5, APIs: 3, Instructions: 27
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0084131C
FindFirstFileA.KERNELBASE(?,?), ref: 00841334
FindClose.KERNEL32(000000FF), ref: 00841347

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: Find$CloseDirectoryFileFirstWindows
String ID:
API String ID: 2671548583-0
Opcode ID: eb3806b1f3eeda7201857ee2412f257c61ceeeddf7bee04db62eb67b604c12b2
Instruction ID: 853f5f40b6ab73e2d5023fee921305c61f1580060fc2c4ae1f0194c8362359d9
Opcode Fuzzy Hash: eb3806b1f3eeda7201857ee2412f257c61ceeeddf7bee04db62eb67b604c12b2
Instruction Fuzzy Hash: 2BF0DA79D01208EBCB10DFA4D94CADDBB78FB09710F104299E519A3290D7745B84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00842800 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 160
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,008423C6,?,?,?,?), ref: 00842808

Part of subcall function 00841490: StrStrIA.SHLWAPI(00000000,), ref: 008414A6

send.WS2_32(?,HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request,0000003F,00000000), ref: 00842843
send.WS2_32(?,HTTP/1.1 407 Proxy Authentication RequiredProxy-Authenticate: Basic realm="Proxy"Content-Length: 33407 Proxy Authentication Required,0000008C,00000000), ref: 0084287E

Strings

HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway, xrefs: 00842981
HTTP/1.1 200 OK, xrefs: 008429D4
HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway, xrefs: 008429B3
HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request, xrefs: 0084283A
HTTP/1.1 407 Proxy Authentication RequiredProxy-Authenticate: Basic realm="Proxy"Content-Length: 33407 Proxy Authentication Required, xrefs: 00842875
HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request, xrefs: 00842951

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: send$_chkstk
String ID: HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request$HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request$HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway$HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway$HTTP/1.1 200 OK$HTTP/1.1 407 Proxy Authentication RequiredProxy-Authenticate: Basic realm="Proxy"Content-Length: 33407 Proxy Authentication Required
API String ID: 1661165017-3437031791
Opcode ID: 3bbb8e7f259e2c0995969b2c08ed553180a5cdb1c325b94dd6fe7208601ab8ab
Instruction ID: fb346b8809be8120f127d30451e51b123df4aa863e277f7822420bf66c5f89d0
Opcode Fuzzy Hash: 3bbb8e7f259e2c0995969b2c08ed553180a5cdb1c325b94dd6fe7208601ab8ab
Instruction Fuzzy Hash: 19517B7490424CABDB14CFA4DC49BEEBBB4FB08710F508658F621EB2C0D7B49A44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00841A10 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 99
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00841A2C
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00841A62
lstrcpyA.KERNEL32(00844028,kilo-torrent.org), ref: 00841AAC
lstrcpyA.KERNEL32(00844068,kilo-torrent.org), ref: 00841ABC
WSAStartup.WS2_32(00000202,?), ref: 00841ACE
wsprintfA.USER32 ref: 00841AEB
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 00841AFC
GetLastError.KERNEL32 ref: 00841B0B
CloseHandle.KERNEL32(00000000), ref: 00841B1C
CreateThread.KERNELBASE(00000000,00000000,00841540,00000000,00000000,00000000), ref: 00841B3E
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00841B51
CloseHandle.KERNEL32(00000000), ref: 00841B62

Strings

p/#v, xrefs: 00841AFC
kilo-torrent.org, xrefs: 00841AA2
Global\%s, xrefs: 00841AE2
kilo-torrent.org, xrefs: 00841AB2

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: Close$CreateHandlelstrcpy$ChangeErrorFindInformationLastMutexNotificationPathStartupTempThreadVolumewsprintf
String ID: Global\%s$kilo-torrent.org$kilo-torrent.org$p/#v
API String ID: 3278163433-1876745359
Opcode ID: 5c6a4e5af6e8241291a5a19938ad6a9a7dc98f5d192e10f1d08cc79dc9393288
Instruction ID: 54417d5bf6b82354a1d62ad2e93103f80173c65e2498faad4fecf4058cbb6d63
Opcode Fuzzy Hash: 5c6a4e5af6e8241291a5a19938ad6a9a7dc98f5d192e10f1d08cc79dc9393288
Instruction Fuzzy Hash: B0413B78A4070CEBEB20DFA0EC4DBADB774FB44701F204559E605A62D0D7B95B84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008421D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 189
memorynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL ref: 008421D8
recv.WS2_32(?,?,00000001,00000002), ref: 0084227E

Part of subcall function 00841170: socket.WS2_32(00000002,00000001,00000006), ref: 00841183
Part of subcall function 00841170: htons.WS2_32(00841714), ref: 008411A6
Part of subcall function 00841170: connect.WS2_32(000000FF,?,00000010), ref: 008411BA
Part of subcall function 00841170: closesocket.WS2_32(000000FF), ref: 008411C9

closesocket.WS2_32(?), ref: 00842415

Part of subcall function 00842CA0: recv.WS2_32(?,?,00000001,00000000), ref: 00842CBC

closesocket.WS2_32(000000FF), ref: 0084235A

Part of subcall function 00842800: _chkstk.NTDLL(?,008423C6,?,?,?,?), ref: 00842808
Part of subcall function 00842800: send.WS2_32(?,HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request,0000003F,00000000), ref: 00842843

Part of subcall function 00841E50: select.WS2_32(00000000,00000002,00000000,00000000,00000002), ref: 00841EB3
Part of subcall function 00841E50: recv.WS2_32(00000000,00000002,00001000,00000000), ref: 00841EE3

GetProcessHeap.KERNEL32(00000000,?), ref: 00842421
HeapFree.KERNEL32(00000000), ref: 00842428

Strings

L, xrefs: 008422B6

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: closesocketrecv$Heap_chkstk$FreeProcessconnecthtonsselectsendsocket
String ID: L
API String ID: 3825173158-2909332022
Opcode ID: f6b9ec846c889c7528c7005a5fb0096614c759dcb33c744fa36e122ed8896b61
Instruction ID: 56d945c8bcf2c6377c745c863f77ed0e740bddaafe876d7ac74c19f2fa9b2573
Opcode Fuzzy Hash: f6b9ec846c889c7528c7005a5fb0096614c759dcb33c744fa36e122ed8896b61
Instruction Fuzzy Hash: 8D71A1B5D0821CABCB04CF98D894AFEBBB5FF48300F548159F955EB251D239DA81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00841E50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32(00000000,00000002,00000000,00000000,00000002), ref: 00841EB3
recv.WS2_32(00000000,00000002,00001000,00000000), ref: 00841EE3
send.WS2_32(?,00000002,00000000,00000000), ref: 00841F28
recv.WS2_32(?,00000002,00001000,00000000), ref: 00841F54
send.WS2_32(00000000,00000002,00000000,00000000), ref: 00841F75

Strings

POST, xrefs: 00841F0D
GET , xrefs: 00841F02

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recvsend$select
String ID: GET $POST
API String ID: 1492468295-2494278042
Opcode ID: 115e88ccffae3bbc3d72bf6f2b4fd4482ea4aefdf39a0e7cc209c4b166f87b61
Instruction ID: 404bae8b3df387abadf162f74cd78e8e637af1123cd5a4b9687b21f587d80df6
Opcode Fuzzy Hash: 115e88ccffae3bbc3d72bf6f2b4fd4482ea4aefdf39a0e7cc209c4b166f87b61
Instruction Fuzzy Hash: 09311A7560020CABDF18CF94CC59BEA77B4FB48744F108558FA15DB280D7B0EA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00842CA0 Relevance: 10.7, APIs: 7, Instructions: 205
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,00000001,00000000), ref: 00842CBC
recv.WS2_32(?,?,00000001,00000000), ref: 00842CDB

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e53bc39a7b989b0e476a7bcc51115ab7ae1f0a3a58593bea5f649eb0d78e7b78
Instruction ID: 5dac1494a45aad07e962c02735ea38934a1d22fab09786e1816cf397fa4beb82
Opcode Fuzzy Hash: e53bc39a7b989b0e476a7bcc51115ab7ae1f0a3a58593bea5f649eb0d78e7b78
Instruction Fuzzy Hash: 7081F174D0824D9ADB14CFA8C8947EEBBB1FF45314F608369F525E62C0D7B98A85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00841C20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI(FFFFFFFF,0000000F,00000000,00000000,YAhoO.Com,00000000), ref: 00841C3D

Part of subcall function 008410F0: lstrcmpiA.KERNEL32(00000000,?), ref: 0084113C

DnsQuery_A.DNSAPI(00000000,00000001,00000000,00000000,?,00000000), ref: 00841C86
DnsFree.DNSAPI(?,00000001), ref: 00841CAA
DnsFree.DNSAPI(YAhoO.Com,00000001), ref: 00841CB5

Strings

YAhoO.Com, xrefs: 00841C32, 00841C49, 00841CB4

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: FreeQuery_$lstrcmpi
String ID: YAhoO.Com
API String ID: 2851467242-2780876924
Opcode ID: ce8a9f922c182fa40823506e09d3f57a0c6a2ba49647d3fb36a062ee904a83c9
Instruction ID: 8a1471e8bcdd5d16594c00ef3ba72abc0fbdc8272b21e3c2e7875ab8f5d50d79
Opcode Fuzzy Hash: ce8a9f922c182fa40823506e09d3f57a0c6a2ba49647d3fb36a062ee904a83c9
Instruction Fuzzy Hash: 85110D74E40308BBDB14DBA4CC85BADB375FB54710F604698FA10AB2C1DB71AE80D791

Uniqueness

Uniqueness Score: -1.00%

Function 00841040 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

closesocket.WS2_32(000000FF), ref: 008410D7

Part of subcall function 00841C20: DnsQuery_A.DNSAPI(FFFFFFFF,0000000F,00000000,00000000,YAhoO.Com,00000000), ref: 00841C3D
Part of subcall function 00841C20: DnsQuery_A.DNSAPI(00000000,00000001,00000000,00000000,?,00000000), ref: 00841C86
Part of subcall function 00841C20: DnsFree.DNSAPI(?,00000001), ref: 00841CAA
Part of subcall function 00841C20: DnsFree.DNSAPI(YAhoO.Com,00000001), ref: 00841CB5

Strings

GMaIl.cOM, xrefs: 0084105B
HOtMaIl.cOM, xrefs: 00841054
YAhoO.Com, xrefs: 0084104D, 008410A0

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: FreeQuery_$closesocket
String ID: GMaIl.cOM$HOtMaIl.cOM$YAhoO.Com
API String ID: 872820492-1204038948
Opcode ID: d0d2818c68e4cf9d69f70f14b62e4b5dd070230d8cfda6ad2dff691daeb69449
Instruction ID: 66dacd44e9647a22a3ace20c90562b6b8ed577e2a84273d01e318f9f3f357aae
Opcode Fuzzy Hash: d0d2818c68e4cf9d69f70f14b62e4b5dd070230d8cfda6ad2dff691daeb69449
Instruction Fuzzy Hash: 071103B0D0464DEBCF10DFE4D9486ADBBB0FB05318F208259D521A6280D3755AD9DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00841170 Relevance: 6.0, APIs: 4, Instructions: 35
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00841183
htons.WS2_32(00841714), ref: 008411A6
connect.WS2_32(000000FF,?,00000010), ref: 008411BA
closesocket.WS2_32(000000FF), ref: 008411C9

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: 4bfdc8563acec2edca2b2cbc58b8988ae9482fbbd8b717c64759d15175991509
Instruction ID: 0b2195abcf57dae1cbc881c5318ed4a855d043c38abbde386cf969a71c13b43a
Opcode Fuzzy Hash: 4bfdc8563acec2edca2b2cbc58b8988ae9482fbbd8b717c64759d15175991509
Instruction Fuzzy Hash: A3014B7890030CEBCB10DFA4DA49AADB775BF45320F204348EA25A72D0D7709B40EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00841D60 Relevance: 4.6, APIs: 3, Instructions: 61
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00841470: InterlockedExchange.KERNEL32(00844018,00841815), ref: 0084147B

Sleep.KERNEL32(00000001), ref: 00841D89
closesocket.WS2_32(?), ref: 00841DFB
WaitForSingleObject.KERNEL32(?,?), ref: 00841E2E

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleSleepWaitclosesocket
String ID:
API String ID: 2788211337-0
Opcode ID: 60bbb1528cf314d2642da9aecdc2255a9f1004ffc7d192549d0022d06808f530
Instruction ID: 25a0af1f74cc6220cbccf973dbb51b33fa04b5f30e0ade43957881fbb3978bd9
Opcode Fuzzy Hash: 60bbb1528cf314d2642da9aecdc2255a9f1004ffc7d192549d0022d06808f530
Instruction Fuzzy Hash: 0911E1BDA00A08DBCB64DBA8FC49B693734FB16705F005219FA12D62D1F7714A64C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00842A20 Relevance: 4.6, APIs: 3, Instructions: 57
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(0000004C,?,00000408,00000000), ref: 00842A42
htons.WS2_32(00000000), ref: 00842A86

Part of subcall function 00841170: socket.WS2_32(00000002,00000001,00000006), ref: 00841183
Part of subcall function 00841170: htons.WS2_32(00841714), ref: 008411A6
Part of subcall function 00841170: connect.WS2_32(000000FF,?,00000010), ref: 008411BA
Part of subcall function 00841170: closesocket.WS2_32(000000FF), ref: 008411C9

send.WS2_32(0000004C,?,00000008,00000000), ref: 00842AEA

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: htons$closesocketconnectrecvsendsocket
String ID:
API String ID: 4232559698-0
Opcode ID: 9c785e6b6a123bba92d9f708809bec2a44bab41902e85ef902356d1e09ae508d
Instruction ID: d9c7629d07657bb133597d14c2d1e750845833cc2c972894e80648bebb7d9046
Opcode Fuzzy Hash: 9c785e6b6a123bba92d9f708809bec2a44bab41902e85ef902356d1e09ae508d
Instruction Fuzzy Hash: 0521D3B090021CABDB24CF94D9487DD7B79FB84300F20C3B8EA15D76C1D2798A84CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00842D51 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,00000104,00000000), ref: 00842DED
send.WS2_32(?,00000007,00000006,00000000), ref: 00842F78

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recvsend
String ID:
API String ID: 740075404-0
Opcode ID: f2f88feae238ac676c5721124704dea977beb3f88f80320ae9d7f92d8356d957
Instruction ID: e5090afb6462e96513db521eb2702b90fb2c8a35e345f7dbb76cf71a82d957b0
Opcode Fuzzy Hash: f2f88feae238ac676c5721124704dea977beb3f88f80320ae9d7f92d8356d957
Instruction Fuzzy Hash: BC01F17490821CDADB10CB98D894BFEB3B0FB04314F604269FA1AD6680D7754AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00841BC0 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00841686), ref: 00841BD1
gethostbyname.WS2_32(00841686), ref: 00841BE4

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 7933b3fdd8854e2bc6dc93db63de84023f7bd7120a37b3354a4d6be7bf904828
Instruction ID: 08c021ba266333869162fda7bfc4b53fa58a8f87e1dd8e9a5edcf165982cbb4f
Opcode Fuzzy Hash: 7933b3fdd8854e2bc6dc93db63de84023f7bd7120a37b3354a4d6be7bf904828
Instruction Fuzzy Hash: 68F0A978D00608EFCB14DFA8D58899DBBB6FF49321F20C2A9E915973A0D7309E80DB40

Uniqueness

Uniqueness Score: -1.00%

Function 008419AC Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0084182F

Part of subcall function 00841D30: setsockopt.WS2_32(?,0000FFFF,00001006,?,00000004), ref: 00841D4E

SetEvent.KERNEL32(?), ref: 008419D8

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: Eventclosesocketsetsockopt
String ID:
API String ID: 2457749076-0
Opcode ID: a7fdac0fbc6f6fe3a9db0366f0b37c3f6f57ccc7a5134502ef59047fdf0a2a24
Instruction ID: 2627abbcb5ad19d48ae99c2106c99d221f263a36fe712a357e00f8405d279859
Opcode Fuzzy Hash: a7fdac0fbc6f6fe3a9db0366f0b37c3f6f57ccc7a5134502ef59047fdf0a2a24
Instruction Fuzzy Hash: 5011E374E0020C9BDF24CBD4E8697BDBF32FB46349F144029E202E6285E73599D0CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00842DFE Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(008422F7), ref: 00842F0F
send.WS2_32(?,00000007,00000006,00000000), ref: 00842F78

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: htonssend
String ID:
API String ID: 1592624528-0
Opcode ID: c4c6673603800c561461990e149c8547f80fa0a6f63f30d5cf07bc86998bdfac
Instruction ID: dc16ff81034b0e6184822745d26b2d2ce692f3d60d342a765b10eaf135f751e3
Opcode Fuzzy Hash: c4c6673603800c561461990e149c8547f80fa0a6f63f30d5cf07bc86998bdfac
Instruction Fuzzy Hash: 88F0967590815D86DB148B98D4547FE7770FB04314F6043A9F52AD67C0CA754EC6CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00841B70 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,00000000,00000000), ref: 00841B99

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: efdcce615d388abfe68dfb3f557546d92a375889a76b3d5c65fdfb006678f373
Instruction ID: 59572dd3870614cde045033da0fe019944fddf1ccd99dc1cd332305c0657aa2f
Opcode Fuzzy Hash: efdcce615d388abfe68dfb3f557546d92a375889a76b3d5c65fdfb006678f373
Instruction Fuzzy Hash: 05F0B775A0020CEFCF04DFA8C998B9DBBB5FF44315F208189E805A7640E730AB94DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00841CD0 Relevance: 1.5, APIs: 1, Instructions: 28networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,0000001A,00000000), ref: 00841D03

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 198bafbab4e362899014a92e122b7c34b5960aca5fe34c968309831c68c47d65
Instruction ID: 4800dff36052c4375869387b72ea19558737f0727da37a85c6e9da92859373a4
Opcode Fuzzy Hash: 198bafbab4e362899014a92e122b7c34b5960aca5fe34c968309831c68c47d65
Instruction Fuzzy Hash: 56F0AFB4A00208EBDB10CF84C585B9DBBB5BB46314F20C288E9489B380C775EA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00842E55 Relevance: 1.5, APIs: 1, Instructions: 25networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(008422F7), ref: 00842F0F
send.WS2_32(?,00000007,00000006,00000000), ref: 00842F78

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: htonssend
String ID:
API String ID: 1592624528-0
Opcode ID: f53764a37ea947cc92510eea96b6c80cd9757c74d422724e7e8b1b3f576939cb
Instruction ID: 05802ccc91a3556b62056867952bb12e3c8530aff81b645b83d671b32fb59f8e
Opcode Fuzzy Hash: f53764a37ea947cc92510eea96b6c80cd9757c74d422724e7e8b1b3f576939cb
Instruction Fuzzy Hash: ECF02B3190850C87DB20CB48E890BFE73B0FB04310FA083A9F51AD66C0CA358ECACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00842E74 Relevance: 1.5, APIs: 1, Instructions: 25networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(008422F7), ref: 00842F0F
send.WS2_32(?,00000007,00000006,00000000), ref: 00842F78

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: htonssend
String ID:
API String ID: 1592624528-0
Opcode ID: e5f647e441961ecaf5f24884de5e36644a94344b1f063f8c3de00561086945a4
Instruction ID: 05802ccc91a3556b62056867952bb12e3c8530aff81b645b83d671b32fb59f8e
Opcode Fuzzy Hash: e5f647e441961ecaf5f24884de5e36644a94344b1f063f8c3de00561086945a4
Instruction Fuzzy Hash: ECF02B3190850C87DB20CB48E890BFE73B0FB04310FA083A9F51AD66C0CA358ECACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00841D30 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001006,?,00000004), ref: 00841D4E

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 569d15e79231ca81af3bcf4c2f945940e23859a81f6f770dcfb37c15e457e90c
Instruction ID: 89582af94b5b798fb479490bb857eed9b16d47b1d973bc655be51c0d7a932394
Opcode Fuzzy Hash: 569d15e79231ca81af3bcf4c2f945940e23859a81f6f770dcfb37c15e457e90c
Instruction Fuzzy Hash: 19D05E78640308BBD724DF84DC42DB97768EB09750F108258BE088B280E6B1AA049790

Uniqueness

Uniqueness Score: -1.00%

Function 00841020 Relevance: 1.3, APIs: 1, Instructions: 8sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00841A10: GetTempPathA.KERNEL32(00000104,?), ref: 00841A2C
Part of subcall function 00841A10: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00841A62
Part of subcall function 00841A10: lstrcpyA.KERNEL32(00844028,kilo-torrent.org), ref: 00841AAC
Part of subcall function 00841A10: lstrcpyA.KERNEL32(00844068,kilo-torrent.org), ref: 00841ABC
Part of subcall function 00841A10: WSAStartup.WS2_32(00000202,?), ref: 00841ACE
Part of subcall function 00841A10: wsprintfA.USER32 ref: 00841AEB
Part of subcall function 00841A10: CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 00841AFC
Part of subcall function 00841A10: GetLastError.KERNEL32 ref: 00841B0B
Part of subcall function 00841A10: CloseHandle.KERNEL32(00000000), ref: 00841B1C
Part of subcall function 00841A10: CreateThread.KERNELBASE(00000000,00000000,00841540,00000000,00000000,00000000), ref: 00841B3E
Part of subcall function 00841A10: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00841B51

Sleep.KERNELBASE(000000FF), ref: 0084102A

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: CloseCreatelstrcpy$ChangeErrorFindHandleInformationLastMutexNotificationPathSleepStartupTempThreadVolumewsprintf
String ID:
API String ID: 75904360-0
Opcode ID: 47af95634f84fda8d80ff58baa2685700da7cbcd929a4744837156cc4791097c
Instruction ID: fcb0a8746d7c9a486ee7199cc9c00b714ea6d6fcd4ef7f6083123f1dcbe5ac69
Opcode Fuzzy Hash: 47af95634f84fda8d80ff58baa2685700da7cbcd929a4744837156cc4791097c
Instruction Fuzzy Hash: C7B0123600566C17C550B39D6C09B05731CA701370F500712743A912D3C98674E49066

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008424A0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,00843160), ref: 008424C1
memcpy.NTDLL(?,?,00000000), ref: 008424EC
StrStrIA.SHLWAPI(00000000,://), ref: 00842506
StrStrIA.SHLWAPI(00000000,00843168), ref: 00842533
StrStrIA.SHLWAPI(?,0084316C), ref: 00842547
StrStrIA.SHLWAPI(00000000,Proxy-Connection: ,?,0084316C), ref: 00842597
lstrcatA.KERNEL32(00000000,00000000,?,0084316C), ref: 008425B4
lstrcatA.KERNEL32(00000000,-00000006,?,0084316C), ref: 008425C5
lstrcatA.KERNEL32(00000000,00000000,?,0084316C), ref: 008425D5
StrStrIA.SHLWAPI(?,00843184,?,0084316C), ref: 008425EC
StrToIntA.SHLWAPI(-00000001,?,00843184,?,0084316C), ref: 00842608

Strings

Proxy-Connection: , xrefs: 0084258E
://, xrefs: 008424FD

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: lstrcat$memcpy
String ID: ://$Proxy-Connection:
API String ID: 4077682737-1088596629
Opcode ID: eed702a348e4ab6a3142885ffd18595a3a0a36a284297587bb820b7a1dab59e8
Instruction ID: 8feef99dfaf3e6e7abd232cb5f75ad1c2738fba931f8d915de7aed1f86d9ec6b
Opcode Fuzzy Hash: eed702a348e4ab6a3142885ffd18595a3a0a36a284297587bb820b7a1dab59e8
Instruction Fuzzy Hash: DE51B678904249EFCB05CFA8D998BAEBBB5FF59304F248658E915A7350C774AA40CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00842620 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 78networkstringCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,00842384,00000000,?,?), ref: 00842628

Part of subcall function 00841490: StrStrIA.SHLWAPI(00000000,), ref: 008414A6

send.WS2_32(00000000,HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request,0000003F,00000000), ref: 00842681

Part of subcall function 008424A0: StrStrIA.SHLWAPI(?,00843160), ref: 008424C1
Part of subcall function 008424A0: memcpy.NTDLL(?,?,00000000), ref: 008424EC
Part of subcall function 008424A0: StrStrIA.SHLWAPI(00000000,://), ref: 00842506
Part of subcall function 008424A0: StrStrIA.SHLWAPI(00000000,00843168), ref: 00842533
Part of subcall function 008424A0: StrStrIA.SHLWAPI(?,0084316C), ref: 00842547
Part of subcall function 008424A0: StrStrIA.SHLWAPI(00000000,Proxy-Connection: ,?,0084316C), ref: 00842597
Part of subcall function 008424A0: lstrcatA.KERNEL32(00000000,00000000,?,0084316C), ref: 008425B4
Part of subcall function 008424A0: lstrcatA.KERNEL32(00000000,-00000006,?,0084316C), ref: 008425C5
Part of subcall function 008424A0: StrStrIA.SHLWAPI(?,00843184,?,0084316C), ref: 008425EC

send.WS2_32(000000FF,HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway,0000003F,00000000), ref: 008426C8
lstrlenA.KERNEL32(?,00000000), ref: 008426E2
send.WS2_32(000000FF,?,00000000), ref: 008426F4

Strings

HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request, xrefs: 00842678
HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway, xrefs: 008426BF

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: send$lstrcat$_chkstklstrlenmemcpy
String ID: HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request$HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway
API String ID: 3621726142-1422229110
Opcode ID: 5ac2120ba16e427d779bf5dd935a7d6af38889ebd871c4c502a3e17b05cea883
Instruction ID: 6fd0afe4310ee16cd78f14821c0703fa397d82ef09a59258e5e7241d6419bf60
Opcode Fuzzy Hash: 5ac2120ba16e427d779bf5dd935a7d6af38889ebd871c4c502a3e17b05cea883
Instruction Fuzzy Hash: A1215E7590020DBBCB14DF98DC45AEEB7B8FB18310F104658FA25E7280E774AB44DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00842B00 Relevance: 10.6, APIs: 7, Instructions: 141networkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00842B1A
send.WS2_32(?,00000005,00000002,00000000), ref: 00842B40
recv.WS2_32(?,?,00000001,00000000), ref: 00842B52

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: recvsendwsprintf
String ID:
API String ID: 2338285716-0
Opcode ID: d0d2c224890d79869bedb962da7ab64088cfe91cf49701922dabc7f133bbd3b9
Instruction ID: 86ef93207c8d9ca5a6042a60297f9b226da49956dc2691bdaf7f794554604fa9
Opcode Fuzzy Hash: d0d2c224890d79869bedb962da7ab64088cfe91cf49701922dabc7f133bbd3b9
Instruction Fuzzy Hash: 16516CB5D0824DFACB04CBA4C895BEEBBB5FF49305F548999F501E6280E3759744CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00842710 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00842731
StrStrIA.SHLWAPI(?,Proxy-Authorization: Basic ), ref: 00842760
StrStrIA.SHLWAPI(?,0084322C), ref: 00842786

Strings

Proxy-Authorization: Basic , xrefs: 00842757
%u:%u, xrefs: 00842728

Memory Dump Source

Source File: 00000000.00000002.3395913884.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.3395898852.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395977393.0000000000843000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395990553.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_WtRLqa6ZXn.jbxd

Similarity

API ID: wsprintf
String ID: %u:%u$Proxy-Authorization: Basic
API String ID: 2111968516-3249395766
Opcode ID: d3794bfc641a5297b8a28c3b31fbc8ba9a248fbcf5b6c8e07a7ad6b5f9fd63c7
Instruction ID: 90a71963795557f7969e4a321f116cdad02ccc20619f190cd9f7a840a351a070
Opcode Fuzzy Hash: d3794bfc641a5297b8a28c3b31fbc8ba9a248fbcf5b6c8e07a7ad6b5f9fd63c7
Instruction Fuzzy Hash: 3F31D579D0420CEBCB04DFA4D885AAEBBB5FB44304F508658F515A7240E774AB84CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WtRLqa6ZXn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: WtRLqa6ZXn.exePID: 6444, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: WtRLqa6ZXn.exePID: 6444, Parent PID: 4004COMMON

Execution Graph

Graph

Callgraph

Windows Analysis Report
WtRLqa6ZXn.exe

Function 00841540 Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 327
memorysleepthreadCOMMON

Function 00841490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55
networkCOMMON

Function 00841360 Relevance: 6.1, APIs: 4, Instructions: 79
COMMON

Function 00841300 Relevance: 4.5, APIs: 3, Instructions: 27
fileCOMMON

Function 00842800 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 160
networkCOMMON

Function 00841A10 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 99
stringsynchronizationthreadCOMMON

Function 008421D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 189
memorynetworkCOMMON

Function 00841E50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 97
networkCOMMON

Function 00842CA0 Relevance: 10.7, APIs: 7, Instructions: 205
networkCOMMON

Function 00841C20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
networkCOMMON

Function 00841040 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
COMMON

Function 00841170 Relevance: 6.0, APIs: 4, Instructions: 35
networkCOMMON

Function 00841D60 Relevance: 4.6, APIs: 3, Instructions: 61
sleepsynchronizationCOMMON

Function 00842A20 Relevance: 4.6, APIs: 3, Instructions: 57
networkCOMMON

Function 00842D51 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMON