Edit tour

Windows Analysis Report
rpzOeQ5QzX.exe

Overview

General Information

Sample name:	rpzOeQ5QzX.exe renamed because original name is a hash value
Original sample name:	cc3ac85b3c5690d542ed9f3266b9bd83.exe
Analysis ID:	1444673
MD5:	cc3ac85b3c5690d542ed9f3266b9bd83
SHA1:	af14f36d9412a1c79453a622a5ad343cc01ca6f7
SHA256:	8eb33da353d3756d8cd4cb9308fd5ef72a9b35441bec41fd17c3f3ee508ea9ab
Tags:	32exetrojan
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

rpzOeQ5QzX.exe (PID: 3328 cmdline: "C:\Users\user\Desktop\rpzOeQ5QzX.exe" MD5: CC3AC85B3C5690D542ED9F3266B9BD83)

cmd.exe (PID: 2360 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvjnshqw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5096 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xnjytljr.exe" C:\Windows\SysWOW64\hvjnshqw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2248 cmdline: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2300 cmdline: "C:\Windows\System32\sc.exe" description hvjnshqw "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4852 cmdline: "C:\Windows\System32\sc.exe" start hvjnshqw MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4904 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1184 MD5: C31336C1EFC2CCB44B4326EA793040F2)

xnjytljr.exe (PID: 6788 cmdline: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d"C:\Users\user\Desktop\rpzOeQ5QzX.exe" MD5: 75240FF630B9C24DB13964D6E038456F)

svchost.exe (PID: 2244 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 1096 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3224 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 1172 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2716 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3328 -ip 3328 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6568 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5129:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4dd1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: rpzOeQ5QzX.exe PID: 3328	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: xnjytljr.exe PID: 6788	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 2244	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.xnjytljr.exe.5f0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.5f0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.xnjytljr.exe.770000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.xnjytljr.exe.770000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.770000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.xnjytljr.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.xnjytljr.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rpzOeQ5QzX.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rpzOeQ5QzX.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rpzOeQ5QzX.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.xnjytljr.exe.610000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.xnjytljr.exe.610000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.xnjytljr.exe.770000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.xnjytljr.exe.770000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.770000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.rpzOeQ5QzX.exe.20c0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.rpzOeQ5QzX.exe.20c0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.svchost.exe.2b40000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.svchost.exe.2b40000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.svchost.exe.2b40000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.svchost.exe.2b40000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.svchost.exe.2b40000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.svchost.exe.2b40000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.xnjytljr.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.xnjytljr.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.xnjytljr.exe.5f0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.xnjytljr.exe.5f0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.xnjytljr.exe.5f0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.xnjytljr.exe.610000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.xnjytljr.exe.610000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.xnjytljr.exe.610000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d"C:\Users\user\Desktop\rpzOeQ5QzX.exe", ParentImage: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, ParentProcessId: 6788, ParentProcessName: xnjytljr.exe, ProcessCommandLine: svchost.exe, ProcessId: 2244, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rpzOeQ5QzX.exe", ParentImage: C:\Users\user\Desktop\rpzOeQ5QzX.exe, ParentProcessId: 3328, ParentProcessName: rpzOeQ5QzX.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2248, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.47.54.36, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 2244, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d"C:\Users\user\Desktop\rpzOeQ5QzX.exe", ParentImage: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, ParentProcessId: 6788, ParentProcessName: xnjytljr.exe, ProcessCommandLine: svchost.exe, ProcessId: 2244, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 2244, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hvjnshqw

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rpzOeQ5QzX.exe", ParentImage: C:\Users\user\Desktop\rpzOeQ5QzX.exe, ParentProcessId: 3328, ParentProcessName: rpzOeQ5QzX.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2248, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3224, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rpzOeQ5QzX.exe

Avira: detected

Antivirus detection for URL or domain

Source: vanaheim.cn:443	URL Reputation: Label: malware
Source: jotunheim.name:443	URL Reputation: Label: malware
Source: jotunheim.name:443	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\xnjytljr.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Found malware configuration

Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for submitted file

Source: rpzOeQ5QzX.exe

Virustotal: Detection: 38%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\xnjytljr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rpzOeQ5QzX.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Unpacked PE file: 0.2.rpzOeQ5QzX.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Unpacked PE file: 12.2.xnjytljr.exe.400000.0.unpack

Source: rpzOeQ5QzX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\hvjnshqw

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.8.199.94 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 98.136.96.91 98.136.96.91
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 104.47.54.36 104.47.54.36

Source: Joe Sandbox View	ASN Name: SPRINTHOSTRU SPRINTHOSTRU
Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: global traffic	TCP traffic: 192.168.2.6:49700 -> 104.47.54.36:25
Source: global traffic	TCP traffic: 192.168.2.6:49708 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 64.233.184.27:25
Source: global traffic	TCP traffic: 192.168.2.6:49712 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rpzOeQ5QzX.exe PID: 3328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xnjytljr.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2244, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.xnjytljr.exe.5f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.5f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.xnjytljr.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.xnjytljr.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00401280 ShellExecuteExW,LocalAlloc,VirtualProtect,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\hvjnshqw\

Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_02B4C913	16_2_02B4C913

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: String function: 020A27AB appears 35 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788

Source: rpzOeQ5QzX.exe, 00000000.00000002.2134878632.0000000000475000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesFilezera> vs rpzOeQ5QzX.exe
Source: rpzOeQ5QzX.exe, 00000000.00000002.2134995554.00000000005E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFilezera> vs rpzOeQ5QzX.exe
Source: rpzOeQ5QzX.exe	Binary or memory string: OriginalFilenamesFilezera> vs rpzOeQ5QzX.exe

Source: rpzOeQ5QzX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.xnjytljr.exe.5f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.5f0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.xnjytljr.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.xnjytljr.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@9/5

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_005D2DFF CreateToolhelp32Snapshot,Module32First,

0_2_005D2DFF

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_02B49A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_02B49A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3748:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1172:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1616:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2716:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

File created: C:\Users\user\AppData\Local\Temp\xnjytljr.exe

Jump to behavior

Source: rpzOeQ5QzX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rpzOeQ5QzX.exe

Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

File read: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Jump to behavior

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-15112
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14900

Source: unknown	Process created: C:\Users\user\Desktop\rpzOeQ5QzX.exe "C:\Users\user\Desktop\rpzOeQ5QzX.exe"
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvjnshqw\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xnjytljr.exe" C:\Windows\SysWOW64\hvjnshqw\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description hvjnshqw "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start hvjnshqw
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d"C:\Users\user\Desktop\rpzOeQ5QzX.exe"
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3328 -ip 3328
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 548
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1184
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvjnshqw\	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xnjytljr.exe" C:\Windows\SysWOW64\hvjnshqw\	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description hvjnshqw "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start hvjnshqw	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3328 -ip 3328	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 548	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1184	Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: rpzOeQ5QzX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Unpacked PE file: 0.2.rpzOeQ5QzX.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Unpacked PE file: 12.2.xnjytljr.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Unpacked PE file: 0.2.rpzOeQ5QzX.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Unpacked PE file: 12.2.xnjytljr.exe.400000.0.unpack

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe

Code function: 12_2_007E1C6F push ss; iretd

12_2_007E1C72

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	File created: C:\Users\user\AppData\Local\Temp\xnjytljr.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hvjnshqw

Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\rpzoeq5qzx.exe

Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

16_2_02B4199C

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-15525
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15345
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_16-7600

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_16-6135

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15323
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15497
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_16-7322

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-15084

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14913
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-15128

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	API coverage: 5.6 %
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	API coverage: 4.1 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 2084	Thread sleep count: 37 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2084	Thread sleep time: -37000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000010.00000002.3360971175.0000000003000000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

API call chain: ExitProcess graph end node

graph_0-15335

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_16-7661

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_005D26DC push dword ptr fs:[00000030h]	0_2_005D26DC
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_020A092B mov eax, dword ptr fs:[00000030h]	0_2_020A092B
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_020A0D90 mov eax, dword ptr fs:[00000030h]	0_2_020A0D90
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_005F092B mov eax, dword ptr fs:[00000030h]	12_2_005F092B
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_005F0D90 mov eax, dword ptr fs:[00000030h]	12_2_005F0D90
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_007D0A34 push dword ptr fs:[00000030h]	12_2_007D0A34

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_02B49A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_02B49A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.8.199.94 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2B40000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B40000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B40000			Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D0B008			Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvjnshqw\	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xnjytljr.exe" C:\Windows\SysWOW64\hvjnshqw\	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description hvjnshqw "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start hvjnshqw	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3328 -ip 3328	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 548	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1184	Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

0_2_00407809

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rpzOeQ5QzX.exe PID: 3328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xnjytljr.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2244, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.770000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.2b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rpzOeQ5QzX.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.xnjytljr.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rpzOeQ5QzX.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.xnjytljr.exe.610000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rpzOeQ5QzX.exe PID: 3328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xnjytljr.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2244, type: MEMORYSTR

Source: C:\Users\user\Desktop\rpzOeQ5QzX.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_02B488B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	16_2_02B488B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rpzOeQ5QzX.exe	38%	Virustotal		Browse
rpzOeQ5QzX.exe	100%	Avira	HEUR/AGEN.1311176
rpzOeQ5QzX.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\xnjytljr.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\xnjytljr.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta7.am0.yahoodns.net	1%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	15%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
google.com	1%	Virustotal	Browse
yahoo.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
vanaheim.cn:443	100%	URL Reputation	malware
jotunheim.name:443	100%	URL Reputation	malware
jotunheim.name:443	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	217.69.139.150	true	true	0%, Virustotal, Browse	unknown
mta7.am0.yahoodns.net	98.136.96.91	true	true	1%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	104.47.54.36	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	141.8.199.94	true	true	15%, Virustotal, Browse	unknown
smtp.google.com	64.233.184.27	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	URL Reputation: malware	unknown
jotunheim.name:443	true	URL Reputation: malware URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
64.233.184.27	smtp.google.com	United States	15169	GOOGLEUS	false
141.8.199.94	vanaheim.cn	Russian Federation	35278	SPRINTHOSTRU	true
98.136.96.91	mta7.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
104.47.54.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1444673
Start date and time:	2024-05-21 04:39:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rpzOeQ5QzX.exe renamed because original name is a hash value
Original Sample Name:	cc3ac85b3c5690d542ed9f3266b9bd83.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.236.44.162, 20.231.239.246, 20.76.201.171, 20.70.246.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:40:44	API Interceptor	9x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
98.136.96.91	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
	0bv3c9AqYs.exe	Get hash	malicious	Pushdo	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse
104.47.54.36	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.11678.1633.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.5284.17028.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	file.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.11.0
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
vanaheim.cn	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	file.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
mxs.mail.ru	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.69.139.150
	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse	94.100.180.31
	.exe	Get hash	malicious	Unknown	Browse	94.100.180.31
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	217.69.139.150
mta7.am0.yahoodns.net	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	SecuriteInfo.com.Win32.BotX-gen.31335.5127.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.111
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.77
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.204.79
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.91
	7b8wRbnmKu.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.76

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	uUyFtCTKDd.elf	Get hash	malicious	Mirai	Browse	94.100.184.243
	https://www.ixxin.cn/go.html?url=https://ok.me/b5SG1?M6bxrJ9vlWS?MtRgHryntBJ	Get hash	malicious	GRQ Scam	Browse	217.20.155.6
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	c40snYcuW6.elf	Get hash	malicious	Mirai	Browse	5.61.23.80
	arm7.elf	Get hash	malicious	Mirai	Browse	217.69.134.17
	SkM9yWax29.elf	Get hash	malicious	Mirai	Browse	178.237.22.126
	base.apk	Get hash	malicious	Anubis BankBot	Browse	178.237.20.131
	UD6c1o6Fhg.elf	Get hash	malicious	Mirai	Browse	94.100.184.227
	BSKbaZ6Mij.elf	Get hash	malicious	Mirai	Browse	94.100.184.245
	https://cloud.mail.ru/stock/hG498Pfe7uJ1fEVeN7iTtbHo	Get hash	malicious	HTMLPhisher	Browse	5.61.23.11
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://flow.page/ladobedocs	Get hash	malicious	HTMLPhisher	Browse	52.98.179.50
	n6N8r2Rjfa	Get hash	malicious	Unknown	Browse	52.109.76.243
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.31526.29136.xlsx	Get hash	malicious	Unknown	Browse	13.107.213.45
	https://winrocket07.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	https://zoom.us/download	Get hash	malicious	Unknown	Browse	13.107.213.45
	https://20maymic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	https://serviappnrems122.z20.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	13.107.213.67
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Setup (1).exe	Get hash	malicious	Unknown	Browse	52.182.141.63
	https://moeteduvn-my.sharepoint.com/:w:/g/personal/nguyenhahuy_c1lvt_cs_gli_moet_edu_vn/Ec0DZcnxoTZGvZEQ93EU3cIBwjF1awEF63hDOlCQZZIozA?e=4%3aFNLNv7&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
SPRINTHOSTRU	ckx1nc2UXk.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer, XWorm	Browse	141.8.192.103
	qxHQmnOvjL.exe	Get hash	malicious	DCRat	Browse	141.8.195.33
	9hupFTW1CI.exe	Get hash	malicious	DCRat	Browse	141.8.192.93
	l35QvlkTXb.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	WVswy22Yv1.exe	Get hash	malicious	DCRat	Browse	141.8.192.169
	Se7CZnlXZZ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	141.8.192.82
	R29s0ssNyZ.exe	Get hash	malicious	DCRat	Browse	141.8.192.126
	nXaujG6G1F.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	141.8.192.103
	n0mtzNARob.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	7NJyHYJtVX.exe	Get hash	malicious	DCRat	Browse	141.8.192.217
YAHOO-NE1US	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.231.20
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	98.137.87.64
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	98.137.155.8
	P5uKPY120j.elf	Get hash	malicious	Mirai	Browse	216.252.107.75
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	98.137.155.8
	https://xsetlp3sattty7yhmls.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	74.6.231.20
	https://ioa.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2FpasswordIP:	Get hash	malicious	HTMLPhisher	Browse	74.6.231.18
	https://trhj.pages.dev/IP:	Get hash	malicious	HTMLPhisher	Browse	74.6.231.18
	K7HXpfSHdt.elf	Get hash	malicious	Mirai, Moobot	Browse	98.138.128.222
	xktih0mnmY.elf	Get hash	malicious	Mirai, Gafgyt	Browse	98.137.87.74

Process:	C:\Users\user\Desktop\rpzOeQ5QzX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13172736
Entropy (8bit):	4.853911281115108
Encrypted:	false
SSDEEP:	24576:r2qdjVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTz:6A
MD5:	75240FF630B9C24DB13964D6E038456F
SHA1:	924DEC401F19FF9784D31D3977E239C09DC60698
SHA-256:	9517E02509B449885F786A820BAC0D8388B189063D26263FA4E7A2AF23F3F50F
SHA-512:	E7031B48F8D58876D8D677C75FBA8AC717C200FD8CBF2138B773CF97D9D47E93466E136B098DF9D275EC02E2D6C809EC78D16F1B0F97F09741F2AE4FA37670DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.R.uu<.uu<.uu<.x'..mu<.x'...u<.x'..Ru<.\|...ru<.uu=..u<.....tu<.x'..tu<.....tu<.Richuu<.........PE..L...L+^e.............................8............@................................../.......................................P..P....P...v...........................Q..............................`F..@...............X............................text...C........................... ..`.rdata..xh.......j..................@..@.data........`...n...J..............@....rsrc....v...P...H..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13172736
Entropy (8bit):	4.853911281115108
Encrypted:	false
SSDEEP:	24576:r2qdjVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTz:6A
MD5:	75240FF630B9C24DB13964D6E038456F
SHA1:	924DEC401F19FF9784D31D3977E239C09DC60698
SHA-256:	9517E02509B449885F786A820BAC0D8388B189063D26263FA4E7A2AF23F3F50F
SHA-512:	E7031B48F8D58876D8D677C75FBA8AC717C200FD8CBF2138B773CF97D9D47E93466E136B098DF9D275EC02E2D6C809EC78D16F1B0F97F09741F2AE4FA37670DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.R.uu<.uu<.uu<.x'..mu<.x'...u<.x'..Ru<.\|...ru<.uu=..u<.....tu<.x'..tu<.....tu<.Richuu<.........PE..L...L+^e.............................8............@................................../.......................................P..P....P...v...........................Q..............................`F..@...............X............................text...C........................... ..`.rdata..xh.......j..................@..@.data........`...n...J..............@....rsrc....v...P...H..................@..@................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.081028628224185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rpzOeQ5QzX.exe
File size:	208'896 bytes
MD5:	cc3ac85b3c5690d542ed9f3266b9bd83
SHA1:	af14f36d9412a1c79453a622a5ad343cc01ca6f7
SHA256:	8eb33da353d3756d8cd4cb9308fd5ef72a9b35441bec41fd17c3f3ee508ea9ab
SHA512:	f250d0f37cd513dd6e647355bd1940d7210093eb27a1bf2d6dbe6ef8673af731c7dccef24c9948a36ac4e06a18803c9082fb7db7ba59a5ecbf94d064981c6a74
SSDEEP:	3072:hpBsWcSkjvEOx+ss6IR15t471Z6/MJlJnmd772g+iBGLYS:h87S4PIj54brGj+i6Y
TLSH:	B114BE1276E184B0F67786329971CA515A3FFCA299758A5B33D8234E1C707C09B26BB3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.R.uu<.uu<.uu<.x'..mu<.x'...u<.x'..Ru<.\|...ru<.uu=..u<.....tu<.x'..tu<.....tu<.Richuu<.........PE..L...L+^e...................

File Icon


Icon Hash:	754145110244484b

Static PE Info

General

Entrypoint:	0x4038c3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x655E2B4C [Wed Nov 22 16:24:44 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	be6912d7f98e28f6fe62d68348833ccb

Entrypoint Preview

Instruction
call 00007F09D135F05Ch
jmp 00007F09D135AFD4h
cmp ecx, dword ptr [00416C08h]
jne 00007F09D135B154h
rep ret
jmp 00007F09D135F1CBh
push ebp
mov ebp, esp
sub esp, 20h
push esi
push edi
push 00000008h
pop ecx
mov esi, 00410030h
lea edi, dword ptr [ebp-20h]
rep movsd
mov esi, dword ptr [ebp+0Ch]
mov edi, dword ptr [ebp+08h]
test esi, esi
je 00007F09D135B165h
test byte ptr [esi], 00000010h
je 00007F09D135B160h
mov ecx, dword ptr [edi]
sub ecx, 04h
push ecx
mov eax, dword ptr [ecx]
mov esi, dword ptr [eax+18h]
call dword ptr [eax+20h]
mov dword ptr [ebp-08h], edi
mov dword ptr [ebp-04h], esi
test esi, esi
je 00007F09D135B15Eh
test byte ptr [esi], 00000008h
je 00007F09D135B159h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040F090h]
pop edi
pop esi
mov esp, ebp
pop ebp
retn 0008h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00416C08h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push ebp
mov ebp, esp
push esi
cld
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [esi+08h]
xor ecx, esi
call 00007F09D135B09Bh
push 00000000h
push esi

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x75000	0x76f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1510c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14660	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xda43	0xdc00	4d0c19d46862ba8790611d5ebf74a48b	False	0.6017933238636364	data	6.691347110625469	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x6878	0x6a00	53f2b9223c05cdc93960f244eb6c8351	False	0.38277564858490565	data	4.718321390297875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x5e4c0	0x16e00	a96898572ff97649388bb2fefbb7c9f6	False	0.9101135587431693	data	7.69885469348813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x75000	0x76f8	0x7800	a1dd299673d24addc503e28a8707735e	False	0.47369791666666666	data	4.793640659331149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x7b280	0x2	data			5.0
RT_CURSOR	0x7b288	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x7b5b8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_ICON	0x753e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.43630063965884863
RT_ICON	0x76288	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.5487364620938628
RT_ICON	0x76b30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5881336405529954
RT_ICON	0x771f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.6011560693641619
RT_ICON	0x77760	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.44439834024896263
RT_ICON	0x79d08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.49437148217636023
RT_ICON	0x7adb0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.5230496453900709
RT_STRING	0x7b968	0x44e	data	Japanese	Japan	0.4573502722323049
RT_STRING	0x7bdb8	0x69e	data	Japanese	Japan	0.43211334120425027
RT_STRING	0x7c458	0x29a	data	Japanese	Japan	0.4864864864864865
RT_GROUP_CURSOR	0x7b6e8	0x22	data			1.0294117647058822
RT_GROUP_ICON	0x7b218	0x68	data	Japanese	Japan	0.6826923076923077
RT_VERSION	0x7b710	0x258	data			0.535

Imports

DLL	Import
KERNEL32.dll	CreateEventA, WriteConsoleW, IsBadStringPtrA, GetLastError, SetLastError, GetProcAddress, RemoveDirectoryA, LoadLibraryA, GetVolumeInformationA, LocalAlloc, GetNumberFormatW, CreateEventW, GetModuleFileNameA, LoadLibraryExA, GetCommTimeouts, BuildCommDCBA, VirtualProtect, SetFileAttributesW, GetSystemDirectoryW, GetConsoleAliasA, GetTickCount, WriteConsoleA, SetComputerNameExA, EncodePointer, DecodePointer, HeapReAlloc, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineW, RaiseException, RtlUnwind, IsProcessorFeaturePresent, HeapAlloc, IsDebuggerPresent, ReadFile, HeapSize, HeapFree, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, CloseHandle, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetStdHandle, WriteFile, GetModuleFileNameW, LoadLibraryExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCurrentThreadId, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetFilePointerEx, GetConsoleMode, LCMapStringW, SetStdHandle, FlushFileBuffers, GetConsoleCP, OutputDebugStringW, GetStringTypeW, CreateFileW
GDI32.dll	GetBoundsRect, GetCharWidthI
ADVAPI32.dll	ReadEventLogW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 04:40:02.832304001 CEST	49700	25	192.168.2.6	104.47.54.36
May 21, 2024 04:40:03.846759081 CEST	49700	25	192.168.2.6	104.47.54.36
May 21, 2024 04:40:05.780283928 CEST	49701	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:05.780376911 CEST	443	49701	141.8.199.94	192.168.2.6
May 21, 2024 04:40:05.780498028 CEST	49701	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:05.862535954 CEST	49700	25	192.168.2.6	104.47.54.36
May 21, 2024 04:40:09.878149033 CEST	49700	25	192.168.2.6	104.47.54.36
May 21, 2024 04:40:17.878889084 CEST	49700	25	192.168.2.6	104.47.54.36
May 21, 2024 04:40:22.883913994 CEST	49708	25	192.168.2.6	98.136.96.91
May 21, 2024 04:40:23.893948078 CEST	49708	25	192.168.2.6	98.136.96.91
May 21, 2024 04:40:25.909373999 CEST	49708	25	192.168.2.6	98.136.96.91
May 21, 2024 04:40:29.909415960 CEST	49708	25	192.168.2.6	98.136.96.91
May 21, 2024 04:40:37.909441948 CEST	49708	25	192.168.2.6	98.136.96.91
May 21, 2024 04:40:42.931816101 CEST	49709	25	192.168.2.6	64.233.184.27
May 21, 2024 04:40:43.924849033 CEST	49709	25	192.168.2.6	64.233.184.27
May 21, 2024 04:40:45.768899918 CEST	49701	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:45.769067049 CEST	443	49701	141.8.199.94	192.168.2.6
May 21, 2024 04:40:45.769187927 CEST	49701	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:45.878945112 CEST	49710	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:45.879024982 CEST	443	49710	141.8.199.94	192.168.2.6
May 21, 2024 04:40:45.879157066 CEST	49710	443	192.168.2.6	141.8.199.94
May 21, 2024 04:40:45.924896002 CEST	49709	25	192.168.2.6	64.233.184.27
May 21, 2024 04:40:49.924870968 CEST	49709	25	192.168.2.6	64.233.184.27
May 21, 2024 04:40:57.940474033 CEST	49709	25	192.168.2.6	64.233.184.27
May 21, 2024 04:41:03.067404032 CEST	49712	25	192.168.2.6	217.69.139.150
May 21, 2024 04:41:04.096798897 CEST	49712	25	192.168.2.6	217.69.139.150
May 21, 2024 04:41:06.096692085 CEST	49712	25	192.168.2.6	217.69.139.150
May 21, 2024 04:41:10.112350941 CEST	49712	25	192.168.2.6	217.69.139.150
May 21, 2024 04:41:18.112613916 CEST	49712	25	192.168.2.6	217.69.139.150
May 21, 2024 04:41:25.929059982 CEST	49710	443	192.168.2.6	141.8.199.94
May 21, 2024 04:41:25.929285049 CEST	443	49710	141.8.199.94	192.168.2.6
May 21, 2024 04:41:25.929369926 CEST	49710	443	192.168.2.6	141.8.199.94
May 21, 2024 04:41:26.200171947 CEST	49713	443	192.168.2.6	141.8.199.94
May 21, 2024 04:41:26.200259924 CEST	443	49713	141.8.199.94	192.168.2.6
May 21, 2024 04:41:26.200380087 CEST	49713	443	192.168.2.6	141.8.199.94

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 04:40:02.799287081 CEST	64995	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:02.831408024 CEST	53	64995	1.1.1.1	192.168.2.6
May 21, 2024 04:40:05.771662951 CEST	64434	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:05.779428959 CEST	53	64434	1.1.1.1	192.168.2.6
May 21, 2024 04:40:22.864625931 CEST	52850	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:22.872256994 CEST	53	52850	1.1.1.1	192.168.2.6
May 21, 2024 04:40:22.872972012 CEST	65095	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:22.880354881 CEST	53	65095	1.1.1.1	192.168.2.6
May 21, 2024 04:40:42.895066977 CEST	57675	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:42.902456045 CEST	53	57675	1.1.1.1	192.168.2.6
May 21, 2024 04:40:42.908421040 CEST	55662	53	192.168.2.6	1.1.1.1
May 21, 2024 04:40:42.915566921 CEST	53	55662	1.1.1.1	192.168.2.6
May 21, 2024 04:41:02.941055059 CEST	59524	53	192.168.2.6	1.1.1.1
May 21, 2024 04:41:02.999489069 CEST	53	59524	1.1.1.1	192.168.2.6
May 21, 2024 04:41:03.000166893 CEST	57515	53	192.168.2.6	1.1.1.1
May 21, 2024 04:41:03.066701889 CEST	53	57515	1.1.1.1	192.168.2.6
May 21, 2024 04:42:04.837346077 CEST	55817	53	192.168.2.6	1.1.1.1
May 21, 2024 04:42:04.918028116 CEST	53	55817	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 21, 2024 04:40:02.799287081 CEST	192.168.2.6	1.1.1.1	0xf4ba	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:05.771662951 CEST	192.168.2.6	1.1.1.1	0x3cd1	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.864625931 CEST	192.168.2.6	1.1.1.1	0xe2d3	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:22.872972012 CEST	192.168.2.6	1.1.1.1	0x3fd	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.895066977 CEST	192.168.2.6	1.1.1.1	0xa876	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:42.908421040 CEST	192.168.2.6	1.1.1.1	0x4dde	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
May 21, 2024 04:41:02.941055059 CEST	192.168.2.6	1.1.1.1	0x5374	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:41:03.000166893 CEST	192.168.2.6	1.1.1.1	0x55e0	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 21, 2024 04:42:04.837346077 CEST	192.168.2.6	1.1.1.1	0xa746	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 21, 2024 04:40:02.831408024 CEST	1.1.1.1	192.168.2.6	0xf4ba	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:02.831408024 CEST	1.1.1.1	192.168.2.6	0xf4ba	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:05.779428959 CEST	1.1.1.1	192.168.2.6	0x3cd1	No error (0)	vanaheim.cn	141.8.199.94	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.872256994 CEST	1.1.1.1	192.168.2.6	0xe2d3	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:22.872256994 CEST	1.1.1.1	192.168.2.6	0xe2d3	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:22.872256994 CEST	1.1.1.1	192.168.2.6	0xe2d3	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:22.880354881 CEST	1.1.1.1	192.168.2.6	0x3fd	No error (0)	mta7.am0.yahoodns.net	67.195.228.111	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.902456045 CEST	1.1.1.1	192.168.2.6	0xa876	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:40:42.915566921 CEST	1.1.1.1	192.168.2.6	0x4dde	No error (0)	smtp.google.com	64.233.184.27	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.915566921 CEST	1.1.1.1	192.168.2.6	0x4dde	No error (0)	smtp.google.com	142.251.173.27	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.915566921 CEST	1.1.1.1	192.168.2.6	0x4dde	No error (0)	smtp.google.com	142.251.168.27	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.915566921 CEST	1.1.1.1	192.168.2.6	0x4dde	No error (0)	smtp.google.com	74.125.206.27	A (IP address)	IN (0x0001)	false
May 21, 2024 04:40:42.915566921 CEST	1.1.1.1	192.168.2.6	0x4dde	No error (0)	smtp.google.com	64.233.184.26	A (IP address)	IN (0x0001)	false
May 21, 2024 04:41:02.999489069 CEST	1.1.1.1	192.168.2.6	0x5374	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 04:41:03.066701889 CEST	1.1.1.1	192.168.2.6	0x55e0	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
May 21, 2024 04:41:03.066701889 CEST	1.1.1.1	192.168.2.6	0x55e0	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
May 21, 2024 04:42:04.918028116 CEST	1.1.1.1	192.168.2.6	0xa746	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
May 21, 2024 04:42:04.918028116 CEST	1.1.1.1	192.168.2.6	0xa746	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
May 21, 2024 04:42:04.918028116 CEST	1.1.1.1	192.168.2.6	0xa746	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
May 21, 2024 04:42:04.918028116 CEST	1.1.1.1	192.168.2.6	0xa746	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	22:39:56
Start date:	20/05/2024
Path:	C:\Users\user\Desktop\rpzOeQ5QzX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rpzOeQ5QzX.exe"
Imagebase:	0x400000
File size:	208'896 bytes
MD5 hash:	CC3AC85B3C5690D542ED9F3266B9BD83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2092973488.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:39:57
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hvjnshqw\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:39:57
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:39:58
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\xnjytljr.exe" C:\Windows\SysWOW64\hvjnshqw\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:39:58
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:39:58
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create hvjnshqw binPath= "C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d\"C:\Users\user\Desktop\rpzOeQ5QzX.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:39:58
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:39:59
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description hvjnshqw "wifi internet conection"
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:39:59
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:39:59
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start hvjnshqw
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:39:59
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:39:59
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe /d"C:\Users\user\Desktop\rpzOeQ5QzX.exe"
Imagebase:	0x400000
File size:	13'172'736 bytes
MD5 hash:	75240FF630B9C24DB13964D6E038456F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2128922943.0000000000610000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2134638344.0000000000770000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xa60000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6788 -ip 6788
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:40:00
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3328 -ip 3328
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:40:01
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 548
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:40:01
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1184
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:40:42
Start date:	20/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	24.8%
Total number of Nodes:	1621
Total number of Limit Nodes:	19

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
\, xrefs: 00409D0C
P, xrefs: 00409DAA
", xrefs: 0040A078
", xrefs: 0040A189
D, xrefs: 00409F8E
", xrefs: 00409EDB

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 005D2DFF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005D2E27
Module32First.KERNEL32(00000000,00000224), ref: 005D2E47

Memory Dump Source

Source File: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, Offset: 005CE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 65df27b692b95a0eee10df01b5295090772c10f42ec0e537a0189985e14cc98a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 42F0C2321003106BD7302AF9A88CB7BBBECFF58721F10012BE652962C0DB70EC058A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 020A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 020A024D

Strings

cess, xrefs: 020A018D
kernel32.dll, xrefs: 020A008F, 020A0095

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 62dd707202abd75336868c3e5dbfb115dc0fafa5c7c726e13029abd26a9509f9
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 69527B74A01229DFDB64CFA8C994BACBBB1BF09304F5480D9E54DAB351DB30AA84DF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 00403718 Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 5dfcc019ed47ccf545e98633f32ebd9cef86c567c83ccfa17dcce2386541df5a
Instruction ID: c77e3c3662200f4b45311faa76e4ca510bd461b46c102563d7fc0ec12242b992
Opcode Fuzzy Hash: 5dfcc019ed47ccf545e98633f32ebd9cef86c567c83ccfa17dcce2386541df5a
Instruction Fuzzy Hash: 1E415C75D00616EFCB20DF65C4805AEBBF9FF08706B1085BAE856A7791D334AE80CB94

Function 020A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,020A0223,?,?), ref: 020A0E19
SetErrorMode.KERNELBASE(00000000,?,?,020A0223,?,?), ref: 020A0E1E

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 33b567a1a33f63f792c9747ca2383e3da36be57c6f4a5996c5fab058136cccf8
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: D9D0123224522CB7DB412AD4DC09BCEBB5CDF09BA6F408021FB0DE9080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 005D2ABE Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005D2B0F

Memory Dump Source

Source File: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, Offset: 005CE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e577fbc29f1d3fabea633cd358fde7960b03d55f72b96ba81fc215ec2e3cafcf
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A7112B79A00208EFDB01DF98C985E98BFF5AF08351F058095F9489B362D371EA90DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

flags_upd, xrefs: 0040CE4A
wtm_r, xrefs: 0040C97F
4, xrefs: 0040D9F7
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
local_time, xrefs: 0040CACD
drivers\, xrefs: 0040D067
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
wtm_w, xrefs: 0040C96C
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
\, xrefs: 0040D39D
@, xrefs: 0040D754
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
wtm_c, xrefs: 0040C956
.sys, xrefs: 0040D0CC
lid_file_upd, xrefs: 0040CE6A
srv_time, xrefs: 0040CABB
\, xrefs: 0040D3A7

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtSetInformationToken, xrefs: 00401175
RtlNtStatusToDosError, xrefs: 00401194
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
RtlSetLastWin32Error, xrefs: 004010D6
NtOpenProcessToken, xrefs: 004011D4
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
NtClose, xrefs: 004011B4
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtFilterToken, xrefs: 0040122B
NtQueryInformationToken, xrefs: 00401262
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
ntdll.dll, xrefs: 0040100D

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Jan, xrefs: 0040B256
Oct, xrefs: 0040B295
Jul, xrefs: 0040B280
Nov, xrefs: 0040B29C
Thu, xrefs: 0040B241
Sep, xrefs: 0040B28E
May, xrefs: 0040B272
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Mon, xrefs: 0040B22C
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Tue, xrefs: 0040B233
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
Wed, xrefs: 0040B23A

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00401316
D, xrefs: 004015C6
@, xrefs: 00401380
<, xrefs: 00401378
uac, xrefs: 00401628
useless, xrefs: 0040161E
, xrefs: 00401462
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: a0e9a54620e17a19c471557000c2f4691014b1237bb567fcc585c5994024cd6c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: a0e9a54620e17a19c471557000c2f4691014b1237bb567fcc585c5994024cd6c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
start_srv, xrefs: 00401E6C
net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 020A65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 020A65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 020A6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 020A6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 020A6652

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: cb6ad25cb2fbb81a7722e61bf799b7e70cbe1e7a66b366e7971022246c863432
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: D5118F71600218BFDB619FB9DC1AF9B3FACEB057A5F044024FA09A7250D7B2DD009AA4

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 020A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 020A09DC, 020A09DF, 020A09E4
l, xrefs: 020A0966
., xrefs: 020A095F

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: e5b966f5177895d4a891215d54029842e30c239b6072a214755b45d58e048c9d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 303139B6910709DFDB11CF99C884BAEBBF6FF48324F55404AD441AB210D771EA45CBA4

Function 005D26DC Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

n&], xrefs: 005D26E2

Memory Dump Source

Source File: 00000000.00000002.2134977363.00000000005CE000.00000040.00000020.00020000.00000000.sdmp, Offset: 005CE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID:
String ID: n&]
API String ID: 0-1795985749
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 74d2a5ede717648075ea8e3abb3227dea83363ba27dbfb3d1156254d567540d7
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 741170723401009FDB64DE59DCD1EA677EAFB99360B298056ED04CB311D675EC42C760

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 020A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 831887fff615f53a1c2c35c260c0fa2974eaa716cdb29c84aef25042a810f2bd
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1201DB776117088FDF21CFA4C814BAA33F6FB86216F8544B5D506D7241E774A941DB90

Function 020A9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 020A9E6D
lstrcpy.KERNEL32(?,00000000), ref: 020A9FE1
lstrcat.KERNEL32(?,?), ref: 020A9FF2
lstrcat.KERNEL32(?,0041070C), ref: 020AA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 020AA054
DeleteFileA.KERNEL32(?), ref: 020AA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 020AA0D6
lstrcpy.KERNEL32 ref: 020AA12F
lstrlen.KERNEL32(00000022), ref: 020AA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 020A9F13

Part of subcall function 020A7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 020A7081

Part of subcall function 020A6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rftxcrag,020A7043), ref: 020A6F4E
Part of subcall function 020A6F30: GetProcAddress.KERNEL32(00000000), ref: 020A6F55
Part of subcall function 020A6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 020A6F7B
Part of subcall function 020A6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 020A6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 020AA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 020AA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 020AA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 020AA21B
GetDriveTypeA.KERNEL32(?), ref: 020AA265
lstrcat.KERNEL32(?,00000000), ref: 020AA29F
lstrcat.KERNEL32(?,00410A34), ref: 020AA2C5
lstrcat.KERNEL32(?,00000022), ref: 020AA2D9
lstrcat.KERNEL32(?,00410A34), ref: 020AA2F4
wsprintfA.USER32 ref: 020AA31D
lstrcat.KERNEL32(?,00000000), ref: 020AA345
lstrcat.KERNEL32(?,?), ref: 020AA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 020AA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 020AA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 020AA1D1

Part of subcall function 020A9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 020A999D
Part of subcall function 020A9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 020A99BD
Part of subcall function 020A9966: RegCloseKey.ADVAPI32(?), ref: 020A99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 020AA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 020AA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 020AA41D

Strings

\, xrefs: 020A9F73
", xrefs: 020AA142
D, xrefs: 020AA1F5
", xrefs: 020AA2DF
P, xrefs: 020AA011
", xrefs: 020AA3F0

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 345476fdb12c07567663f895dd202cf9c58f0bc578d5f07df5a6f900eb2ddf92
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 89F12EB1D4035DAEDF12DBE08C99EEF7BBDAB08304F8484A6E605E2141E7758684DF64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 020A7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 020A7D21
GetUserNameA.ADVAPI32(?,?), ref: 020A7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020A7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 020A7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 020A7DC0
EqualSid.ADVAPI32(?,?), ref: 020A7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 020A7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020A7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 020A7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 020A7E12
LocalFree.KERNEL32(00000000), ref: 020A7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 020A7E35

Strings

PromptOnSecureDesktop, xrefs: 020A7FA0
D, xrefs: 020A7D73

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 0637db7c9990cf519c47353e6708ccefcffa209ff46348719934da6d2ebb7f3c
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 41A16B71900209AFDF52CFA0DC98FEEBFB9FB08304F44816AE505E6160D7758A84DB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
Jan 13 2018, xrefs: 0040653A
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too small respons, xrefs: 0040A9C9
mail from:<%s>, xrefs: 0040A848
helo %s, xrefs: 0040A803
AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
rcpt to:<%s>, xrefs: 0040A855
ESMTP, xrefs: 0040AA38
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Incorrect respons, xrefs: 0040AB39
ehlo %s, xrefs: 0040A7F5
quit, xrefs: 0040A86C
., xrefs: 0040A8CA

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 020A7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 020A7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020A7ACD
GetLengthSid.ADVAPI32(?), ref: 020A7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 020A7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 020A7B1F
EqualSid.ADVAPI32(?,?), ref: 020A7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 020A7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020A7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 020A7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 020A7B77
LocalFree.KERNEL32(00000000), ref: 020A7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 020A7B9A
GetAce.ADVAPI32(?,?,?), ref: 020A7BCA
EqualSid.ADVAPI32(?,?), ref: 020A7BF1
DeleteAce.ADVAPI32(?,?), ref: 020A7C0A
EqualSid.ADVAPI32(?,?), ref: 020A7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 020A7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020A7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 020A7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 020A7CE0
LocalFree.KERNEL32(00000000), ref: 020A7CEE

Strings

D, xrefs: 020A7AC3

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: d4f6ae7d1b89637be8473dcf23a6ec6b1efb09bdba51b7ec22e4f717dec1f03f
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: A2814D71900219AFDB12CFE4DD94FEEBBF8AF08304F44817AE505E6160D7759641DBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 020A858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 020A865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 020A867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 020A86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 020A86B1

Strings

PromptOnSecureDesktop, xrefs: 020A85B6, 020A8645, 020A86BD, 020A8708, 020A87C5, 020A8812, 020A88E9, 020A8905
", xrefs: 020A896C

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 9d4e47e9dfae253e2eae7b4b49cc444ac92c217678933ff5f72bc221e5dcfe81
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: DEC1C4B1900309BEEB52EBE4DC95EEF7BBDEB04304F548075F504E6050EBB18A94AB65

Function 020A14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 020A1601
lstrlenW.KERNEL32(-00000003), ref: 020A17D8

Strings

<, xrefs: 020A15DF
, xrefs: 020A16C9
@, xrefs: 020A15E7
D, xrefs: 020A182D

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: a442a84df4adc8caf7d1d3a09cdf5d8579a17bf7f4e7e7fe93dfb48c43e0d4f5
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: EDF17CB15083419FD721CFA4C898BABF7E5FB88304F80892DF59A972A0D7B4D944CB56

Function 020A7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020A76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 020A7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 020A778F
___ascii_stricmp.LIBCMT ref: 020A78B4
RegCloseKey.ADVAPI32(?), ref: 020A794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 020A796D
RegCloseKey.ADVAPI32(?), ref: 020A797E
RegCloseKey.ADVAPI32(?), ref: 020A79AC
RegCloseKey.ADVAPI32(?), ref: 020A7A56

Part of subcall function 020AF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,020A772A,?), ref: 020AF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 020A79F6
RegCloseKey.ADVAPI32(?), ref: 020A7A4D

Strings

PromptOnSecureDesktop, xrefs: 020A76C5, 020A76CA, 020A76E5, 020A7782, 020A77E6, 020A7862, 020A787B, 020A79C2
", xrefs: 020A7800

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 62bda84a10ba7cf96a6639c2855975faa0b81b43f15a49c772ecd50987c6bacc
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: EAC1B571900309AFDB529BE4DC54FEEBBF9EF49310F9440A6E504E6160EB719A84DB60

Function 020A2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 020A2CED
socket.WS2_32(00000002,00000002,00000011), ref: 020A2D07
htons.WS2_32(00000000), ref: 020A2D42
select.WS2_32 ref: 020A2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 020A2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 020A2E62

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 412e430a3b88a70fad87d589bfb8095c6f4033a5f58d33fb7ccbd1c826ac9f99
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: A961EF71504305AFC321EFA0DC58BABBBE8FB88745F804829FD8597151D7B5D880EBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 020A958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 020A95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020A95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 020A95DC
wsprintfA.USER32 ref: 020A9635
wsprintfA.USER32 ref: 020A9673
wsprintfA.USER32 ref: 020A96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 020A9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 020A978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 020A97D8

Strings

PromptOnSecureDesktop, xrefs: 020A9604, 020A9624, 020A9662, 020A9683, 020A96B6, 020A96DF, 020A9701, 020A9734, 020A9780, 020A97B7

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 62c9520377fa85e79f4d849210d7de1b2a0d4281b18f5a9853740010a1bc9257
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 87A149B2A0030CAFEB22DFE0CC95FDE3BADAB04745F904026FA1596151E7B59584DFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%TO_EMAIL, xrefs: 0040B473
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%FROM_DOMAIN, xrefs: 0040B41E
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 020A1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 020A202D
GetSystemInfo.KERNEL32(?), ref: 020A204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 020A206A
GetProcAddress.KERNEL32(00000000), ref: 020A2071
GetCurrentProcess.KERNEL32(?), ref: 020A2082
GetTickCount.KERNEL32 ref: 020A2230

Part of subcall function 020A1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 020A1E7C

Strings

hi_id, xrefs: 020A217D, 020A2182, 020A219A
flags_upd, xrefs: 020A20A5, 020A20AA, 020A20E3
localcfg, xrefs: 020A2091, 020A2098, 020A20AB, 020A20E4, 020A20F3, 020A2119, 020A2138, 020A214E, 020A2166, 020A2183, 020A219B, 020A21B7, 020A21D7
work_srv, xrefs: 020A20C5

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 48b3b098f2e1f3fb972b998b3423a9b0f9b00ffb04360d380e918ee76733cd36
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: E251D5B0500348AFE330AFB58C95FA7BAECEF54704F80493DF99682142D7B9A584DB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 020A3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 020A3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 020A3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 020A3095
RtlAllocateHeap.NTDLL(00000000), ref: 020A30B6
htons.WS2_32(00000035), ref: 020A30EF
inet_addr.WS2_32(?), ref: 020A30FA
gethostbyname.WS2_32(?), ref: 020A310D
HeapFree.KERNEL32(00000000), ref: 020A314D

Strings

iphlpapi.dll, xrefs: 020A3062, 020A3067, 020A3077

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: baa5971caa1a10f735480e3f2a78720f46e18442652965d16afe758e967ab6d7
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: E0313831A00706ABCF529BF89C58BAE7BF8EF04324F5441A5F518E7290DB74D581DB58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 020A6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 020A67C3
htonl.WS2_32(?), ref: 020A67DF
htonl.WS2_32(?), ref: 020A67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 020A68F1
ExitProcess.KERNEL32 ref: 020A69BC

Strings

localcfg, xrefs: 020A6994
except_info, xrefs: 020A698F

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 8320da11aa159f6d68ddd7f0c737b5fccf35bec2514bac9506b598a3b9dc5b53
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 88616C71A40208AFDF609FB4DC45FEA77F9FB08300F148066FA69D2161EB7599909F14

Function 020AF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(020ACC84), ref: 020AF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 020AF5CE
closesocket.WS2_32(00000000), ref: 020AF5DC

Strings

time_cfg, xrefs: 020AF58A

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: e2aaa832eaffb611bf0f65115c64ab05f541083ae64ac54ad25b05570a415079
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: B6318E72900219ABDB11DFA9DC88DEE7BFCEF88350F104566F905D3150E7718A819BE4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 020A2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 020A2FA1
LoadLibraryA.KERNEL32(?), ref: 020A2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 020A2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 020A3000
RtlAllocateHeap.NTDLL(00000000), ref: 020A3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 020A3032

Strings

dnsapi.dll, xrefs: 020A2F90

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 8b190a9ef58e854df51934a2e3d157df8da181a8e0b11b2d6e77f3198e8c6ad1
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8A219271D00329BBCB229B94DC59EEEBBB8EF08B10F408471F901E7140D7B59A819BD4

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 020A6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rftxcrag,020A7043), ref: 020A6F4E
GetProcAddress.KERNEL32(00000000), ref: 020A6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 020A6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 020A6F92

Strings

PromptOnSecureDesktop, xrefs: 020A6F9D, 020A6FBF, 020A6FCF, 020A6FE5, 020A6FF5
\\.\pipe\rftxcrag, xrefs: 020A6F37
C:\Windows\SysWOW64\, xrefs: 020A6F30, 020A6F38, 020A6F65, 020A6F6C, 020A6F7A, 020A6F85, 020A6F91, 020A6FA9, 020A6FC6, 020A6FEC

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\rftxcrag
API String ID: 1082366364-519530613
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: b7fbcaec9d9943d5adcc10cd0842c48ebca07a00c99b8492a44c5a7989218970
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 3D2143217403407EF76353709CADFFB2E9D8B12764F8C80A5F800E6491DBDA80D692AD

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 020A92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 020A92E2
wsprintfA.USER32 ref: 020A9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 020A9375
lstrlen.KERNEL32(?,?,00000000), ref: 020A9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 020A9394
CloseHandle.KERNEL32(00000000), ref: 020A939B

Strings

PromptOnSecureDesktop, xrefs: 020A932B, 020A9343, 020A935E

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: e428086bef2473dd5eb0babbad6029123c8c28ef116fd534fc765cf5e6cca1d9
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 791196B27402147BE7216772EC0DFEF3A7EDBC8B10F40C075BB09E5091EAB54A419A64

Function 020A99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 020A9A18
GetThreadContext.KERNEL32(?,?), ref: 020A9A52
TerminateProcess.KERNEL32(?,00000000), ref: 020A9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 020A9A98
SetThreadContext.KERNEL32(?,00010002), ref: 020A9AB5
ResumeThread.KERNEL32(?), ref: 020A9AC2

Strings

D, xrefs: 020A9A10

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: b7d0c6e693ee884e802bbef01839e6c412e5f7b4673f4c3985bb06bc906819cf
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: DA216BB1A01219BBDF119BE1DC09EEF7BBCEF14750F804061BA09E1050E7718A40DBA4

Function 020A1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 020A1C18
LoadLibraryA.KERNEL32(004102C8), ref: 020A1C26
GetProcessHeap.KERNEL32 ref: 020A1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 020A1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 020A1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 020A1D02
FreeLibrary.KERNEL32(?), ref: 020A1D0B

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 57b16dbde93976a37d884de8d13fac99443055deb654ac47ea0e5f82f3ffbc5b
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 0A315C32E00319BFCB529FE4DC989EEFAB9EB45305F64447AE509A2110D7B54E80EB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 020A6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 020A6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 020A6D22
GetLastError.KERNEL32 ref: 020A6DA7
CloseHandle.KERNEL32(?), ref: 020A6DB5
GetLastError.KERNEL32 ref: 020A6DD6
DeleteFileA.KERNEL32(?), ref: 020A6DE7
GetLastError.KERNEL32 ref: 020A6DFD

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: dc98c336f569d8e243e30c122d1a33d0401ea14ad32e6fff0772d3b5c3118cb4
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: B531DD76D00249BFCF019FE4DD58ADE7FBDEB48340F588065E211A3250D7728A95AB61

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 020A93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020A93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 020A93CD
CharToOemA.USER32(?,?), ref: 020A93DB
wsprintfA.USER32 ref: 020A9410

Part of subcall function 020A92CB: GetTempPathA.KERNEL32(00000400,?), ref: 020A92E2
Part of subcall function 020A92CB: wsprintfA.USER32 ref: 020A9350
Part of subcall function 020A92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 020A9375
Part of subcall function 020A92CB: lstrlen.KERNEL32(?,?,00000000), ref: 020A9389
Part of subcall function 020A92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 020A9394
Part of subcall function 020A92CB: CloseHandle.KERNEL32(00000000), ref: 020A939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 020A9448

Strings

PromptOnSecureDesktop, xrefs: 020A93FA, 020A93FF, 020A941C

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 4bad0184bc5662c241febddde2b89e8ce6c0143a4e350715061bacf2deb21036
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 7F015EF69002187BDB21A7A19D8DEDF3B7CDB95701F4040A2BB49E2080EAB497C58F75

Function 020AAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 020AAAE5

Strings

, xrefs: 020AABB3
localcfg, xrefs: 020AAD72

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 17879b1082c6a96fff6801515949e322a06f7d547194207997f2bdf13646423d
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 9C714F71B003046AEF728BD4DCA5FEE37B99B00309FA44026F946A60D1DF6655C4EB65

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 020AE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 020ADF6C: GetCurrentThreadId.KERNEL32 ref: 020ADFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 020AE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,020A6128), ref: 020AE950
lstrcmp.KERNEL32(?,00000008), ref: 020AE989

Strings

A, xrefs: 020AE8C6, 020AE8CD, 020AE936, 020AE998
A, xrefs: 020AE960, 020AE965
A, xrefs: 020AE9A0

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: f545a54cfd25686f3e7dbeabb9c66701f5fc1ba2581d4eb50cefb986c4c294aa
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B231AD31A00705DBDFB2CFA4C8A4BAA7BE4FF05724F80893AE59587551D370E884EB91

Function 020A6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 020A6E19

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 64c684afc3d1ba0d1381d759c4507e510c8cfa718d00bd45f358d0d86cc76cc5
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 8E215872204219FFDF11EBB0EC58EDF7EBDEB48264B548421F502D1090EB72DA00AA74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 020AC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 020AC6B4
InterlockedIncrement.KERNEL32(020AC74B), ref: 020AC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,020AC747), ref: 020AC728
CloseHandle.KERNEL32(00000000,?,020AC747,00413588,020A8A77), ref: 020AC733

Strings

localcfg, xrefs: 020AC544

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: e9e086568a1c7ee87f1347cde489bdf311e39b175b4a729c56fd2f93dbe96782
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 46515FB1A00B418FD765CFA9C5E462ABBE9FB48304B91593FE18BC7A90D774E840DB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 020AE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,020AE50A,00000000,00000000,00000000,00020106,00000000,020AE50A,00000000,000000E4), ref: 020AE319
RegSetValueExA.ADVAPI32(020AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020AE38E
RegDeleteValueA.ADVAPI32(020AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020AE3BF
RegCloseKey.ADVAPI32(020AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,020AE50A), ref: 020AE3C8

Strings

PromptOnSecureDesktop, xrefs: 020AE33A

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: e3c57fa482e4ec4bd7f65844f39fe8369047f54edc07199bf2a12eae9230f1e9
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 5B214B72A00219BBDB219FE5EC99EDE7FA9EF08750F408071E904A6150E3718A54EBA0

Function 020A71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 020A71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020A7228
LocalFree.KERNEL32(?,?,?), ref: 020A7286
wsprintfA.USER32 ref: 020A729D

Strings

|, xrefs: 020A721A

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 9c3f6858c04c58a06b34b382372901a9ce95546a2e064b08169d13577b49c1db
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: C2312572A00209BBDB41DFA8DC59ADE7BECEF04354F14C066F859DB210EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 020AB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 020AB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 020AB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 020AB548
GetTimeZoneInformation.KERNEL32(?), ref: 020AB590
wsprintfA.USER32 ref: 020AB61E

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: f150773dda0793bd3276381b1c2399d951d491184b46ea13f21b3fb5c3ce78fb
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 03513FB1D0021CAACF58CFD5D8885EEBBB9BF48304F50812AF501A6150E7B84AC9DF98

Function 020A62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 020A6303
LoadLibraryA.KERNEL32(?), ref: 020A632A
GetProcAddress.KERNEL32(00000000,?), ref: 020A63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 020A6405

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 5353c7f275d431060810d2b79ce2a4649f92745bf3322283152fe95f3705a9a7
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 67418B72A00205EBDF55CF98C8A4BADB7F8EF04318F588168E815D7290D772E981EB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 020AE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 020ADF6C: GetCurrentThreadId.KERNEL32 ref: 020ADFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,020AA6AC), ref: 020AE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,020AA6AC), ref: 020AE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,020AA6AC), ref: 020AE819

Strings

PromptOnSecureDesktop, xrefs: 020AE840, 020AE845, 020AE87C, 020AE89B

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 5c94dceff5da678b30361be31a5d23c0c67be7490aa11b8a7fcbb493e860c19c
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 592137B1A003007AE22177B19C1AFEF3E4DCB647A0F900034BA0DA55D3EA959550AAB5

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 020A7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020A76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 020A796D
RegCloseKey.ADVAPI32(?), ref: 020A797E

Strings

PromptOnSecureDesktop, xrefs: 020A76C5, 020A76CA, 020A76E5

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 622e2785470884664be2856fd484a263f2d59fec3fef4b46958dcadd997bb09f
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 3C11EE30A00209AFDB128FA9DC45FEFBFB9EB91304F548161F511E62A0E3B18940DB60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 020A9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 020A999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 020A99BD
RegCloseKey.ADVAPI32(?), ref: 020A99C6

Strings

PromptOnSecureDesktop, xrefs: 020A9989, 020A998E, 020A99B0, 020A99D3

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 82e1207613c46158cdce7218f3ca1b31f8ab05d5a8418a373dd3e8e939657e47
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: EDF0F6B2680208BFF7116B94EC06FDF3A2DDB94B10F500070FA05B5081F6E59B9096B9

Function 020A28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 020A28FA
gethostbyname.WS2_32(u6A), ref: 020A2906

Strings

u6A, xrefs: 020A28EC, 020A28F9, 020A2905
time_cfg, xrefs: 020A28EB

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 19667259fa9f0e786518a0ca434030b55d659b872ccf59f49f1edbe35d7d98c6
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 74E0C2306052118FCB818B2CF948AC537E4EF0A230F4081A0F840C31A0C734DCC0A740

Function 020A69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 020A69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 020A6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 020A6A3A
CloseHandle.KERNEL32(000000FF), ref: 020A6BD8

Part of subcall function 020AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,020A1DCF,?), ref: 020AEEA8
Part of subcall function 020AEE95: HeapFree.KERNEL32(00000000), ref: 020AEEAF

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 575399a73ab5fc5d05f51c4a58dac653fb874c5bccb2716c7abe43134e0df05f
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8271477190121DEFDF11CFA4CC90AEEBBB9FB08314F54456AE515A6190D7319E82EB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 020A417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 020A41AB
GetLastError.KERNEL32 ref: 020A41B5
WaitForSingleObject.KERNEL32(?,?), ref: 020A41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 020A41D9

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 1ae207f307fec598dd03c1554a30e988796eaab8239c9d4ff73203f6883c9294
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 71014C7A51120AAFDF01DF90ED85BEF3BACEB18255F404461F901E2050D7B0DA509BB5

Function 020A41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 020A421F
GetLastError.KERNEL32 ref: 020A4229
WaitForSingleObject.KERNEL32(?,?), ref: 020A423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 020A424D

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 67b39bc73f535ddf0a5a03c3e3fe20934eccca0e787cb531f4dc2cb7223d4742
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 5E01C872511209AFDF12DF90EE84BEF7BACEB08355F918461F901E2050D7B0DA549BB6

Function 020AE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 020AE066

Strings

A, xrefs: 020AE037, 020AE03C
A, xrefs: 020AE036
A, xrefs: 020AE07F

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 89ffa1f02adc3ae2b85dc7b6edd73b869d333d030506f4f9f1c3c9baf46f7c45
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: FDF062312007029BCB62CFA5D894E82B7E9FB05325B84863AE554C3060D374B4D8DB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 020AE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,020A44E2,00000000,00000000,00000000), ref: 020AE470
CloseHandle.KERNEL32(00000001,00000003), ref: 020AE484

Part of subcall function 020AE2FC: RegCreateKeyExA.ADVAPI32(80000001,020AE50A,00000000,00000000,00000000,00020106,00000000,020AE50A,00000000,000000E4), ref: 020AE319
Part of subcall function 020AE2FC: RegSetValueExA.ADVAPI32(020AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020AE38E
Part of subcall function 020AE2FC: RegDeleteValueA.ADVAPI32(020AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020AE3BF
Part of subcall function 020AE2FC: RegCloseKey.ADVAPI32(020AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,020AE50A), ref: 020AE3C8

Strings

PromptOnSecureDesktop, xrefs: 020AE4F1, 020AE4F6, 020AE537, 020AE561

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 06e9d3476690aeb19766ca9db9114c9429a435a04569856af667b4615351b15c
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 1241C4B2900304BBEB216EE1DC55FEF3BADEB04764F948035FE0994091E7B58650EAB4

Function 020A8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 020A83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 020A8477

Part of subcall function 020A69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 020A69E5
Part of subcall function 020A69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 020A6A26
Part of subcall function 020A69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 020A6A3A

Part of subcall function 020AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,020A1DCF,?), ref: 020AEEA8
Part of subcall function 020AEE95: HeapFree.KERNEL32(00000000), ref: 020AEEAF

Strings

PromptOnSecureDesktop, xrefs: 020A83B2, 020A83B7, 020A8483

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 3911c997b842ba15eb15fbc80bbba88e5164ac54887bfa11f838c2f0e5e0174c
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: A9415FB2900209BFEB51EBE49D90EFF77ADEB04344F9484B6E504E6010F7B15A94AB64

Function 020AE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,020AE859,00000000,00020119,020AE859,PromptOnSecureDesktop), ref: 020AE64D
RegCloseKey.ADVAPI32(020AE859,?,?,?,?,000000C8,000000E4), ref: 020AE787

Strings

PromptOnSecureDesktop, xrefs: 020AE637

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 2e93a725f1bbdc09509549859a504e8bba07442044840688a1bcd07635b32d41
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 3F4108B2D0021DBFDF12AFE4DC94EEEBBB9FB04344F544476EA00A6150E3719A559B60

Function 020AAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 020AAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 020AB00D

Part of subcall function 020AAF6F: gethostname.WS2_32(?,00000080), ref: 020AAF83
Part of subcall function 020AAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 020AAFE6

Part of subcall function 020A331C: gethostname.WS2_32(?,00000080), ref: 020A333F
Part of subcall function 020A331C: gethostbyname.WS2_32(?), ref: 020A3349

Part of subcall function 020AAA0A: inet_ntoa.WS2_32(00000000), ref: 020AAA10

Strings

%OUTLOOK_BND_, xrefs: 020AB076, 020AB07B, 020AB0BE, 020AB0DD

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 0e4b9b3fbe2750f3659914924be73ec9d97ff8c07a77a35dc6ca85a876a6f45c
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 53415DB290030CABDB25EFE0DC55EEE3BADFB08304F54442AF92492151EA75E6549F54

Function 020A9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 020A9536
Sleep.KERNEL32(000001F4), ref: 020A955D

Strings

, xrefs: 020A94D9

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 7c86074caf45bbe106f74a7015050feeed646a0df9599236f2154641d9bd7ae7
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 33411771A0438C6FFBB78BF8D8AEBE63BE59B02314F9801A5D08297192D7744980E711

Function 020ABC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 020AB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 020ABA3A
InterlockedIncrement.KERNEL32(?), ref: 020ABA94
GetTickCount.KERNEL32 ref: 020ABB79
GetTickCount.KERNEL32 ref: 020ABB99
InterlockedIncrement.KERNEL32(?), ref: 020ABE15
closesocket.WS2_32(00000000), ref: 020ABEB4

Strings

%FROM_EMAIL, xrefs: 020ABC7D

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: e4e302f7db2368f2dcb86306ddee97624efbdac943136a3803de7ca0e09b88de
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 76318A715003489FDF65DFE4DCA4AEEB7F9EB58304FA0405AFA2592160EB719684EF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 020A709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 020A70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 020A70F4

Strings

|, xrefs: 020A70E6

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 955874a42cdbd820ad0754c62b19581ac822089818753a42b7ac6276792b81d3
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: D5112A72900218EBDB51CBD8DC84ADEB7FCAB04305F5481B6E501E60A4D7749B88DBA4

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2134783525.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2134783525.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 020A3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 020A2F88: GetModuleHandleA.KERNEL32(?), ref: 020A2FA1
Part of subcall function 020A2F88: LoadLibraryA.KERNEL32(?), ref: 020A2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 020A31DA
HeapFree.KERNEL32(00000000), ref: 020A31E1

Memory Dump Source

Source File: 00000000.00000002.2135105954.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_rpzOeQ5QzX.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 8f336e0ed32f8ab40524d383b65d4c90508c09aecdd725c91de61c18213e4e3a
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: D0519B3190034AAFCF029FA4D898AFAB7B5FF05305F5445A9EC96C7210E772DA19DB90

Analysis Process: xnjytljr.exePID: 6788, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1635
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\rpzOeQ5QzX.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
D, xrefs: 00409F8E
C:\Users\user\Desktop\rpzOeQ5QzX.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 00409EDB
", xrefs: 0040A078
P, xrefs: 00409DAA
", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 0040A1D9
hvjnshqw, xrefs: 0040A389, 0040A397

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\rpzOeQ5QzX.exe$C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$D$P$\$hvjnshqw
API String ID: 2089075347-1371845155
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 005F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005F024D

Strings

kernel32.dll, xrefs: 005F008F, 005F0095
cess, xrefs: 005F018D

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4b65ce4eff50f675edf1d61a99df40599f3613a345a7b7b0bfdd16d4a1f72893
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B9526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB392DB34AE85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00403718 Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 5dfcc019ed47ccf545e98633f32ebd9cef86c567c83ccfa17dcce2386541df5a
Instruction ID: c77e3c3662200f4b45311faa76e4ca510bd461b46c102563d7fc0ec12242b992
Opcode Fuzzy Hash: 5dfcc019ed47ccf545e98633f32ebd9cef86c567c83ccfa17dcce2386541df5a
Instruction Fuzzy Hash: 1E415C75D00616EFCB20DF65C4805AEBBF9FF08706B1085BAE856A7791D334AE80CB94

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 007D1157 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007D117F
Module32First.KERNEL32(00000000,00000224), ref: 007D119F

Memory Dump Source

Source File: 0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp, Offset: 007CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7cc000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: cac90277bda2fe6d4a9b705e87546677d3aea421bfb73d944ff27b7edd088629
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3EF0F635100718BFD7203BF4A88CB6F76F8AF49320F50062AF752912C0DB79EC068A61

Function 005F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005F0223,?,?), ref: 005F0E19
SetErrorMode.KERNELBASE(00000000,?,?,005F0223,?,?), ref: 005F0E1E

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d5a6bee1921c2ef6b516d6639c820d1612de59ea02b9ca9833ad81ad95a80bb3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 21D0123154512CB7D7002A94DC09BDD7F1CDF05B62F048411FB0DD9081C774994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 007D0E16 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007D0E67

Memory Dump Source

Source File: 0000000C.00000002.2134681317.00000000007CC000.00000040.00000020.00020000.00000000.sdmp, Offset: 007CC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7cc000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 8b439f4bdd3464e2fddd134fe37a346083c33e3afde01691a7959a409c3da3fd
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D8113F79A00208FFDB01DF98C985E99BBF5AF08350F058095F9489B362D375EA50DF80

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 005F65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005F65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005F6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 005F6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 005F6652

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: a49562e8eacae7a58c173573b4e41ca400145c8051c494ba2e64521f2bda3d68
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 3411517260021DBFDB219F65DC4AFAB3FA8FB457A5F104024FA09E7251DBB5DD0086A4

Function 005F9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 005F9E6D
lstrcpy.KERNEL32(?,00000000), ref: 005F9FE1
lstrcat.KERNEL32(?,?), ref: 005F9FF2
lstrcat.KERNEL32(?,0041070C), ref: 005FA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 005FA054
DeleteFileA.KERNEL32(?), ref: 005FA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 005FA0D6
lstrcpy.KERNEL32 ref: 005FA12F
lstrlen.KERNEL32(00000022), ref: 005FA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 005F9F13

Part of subcall function 005F7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 005F7081

Part of subcall function 005F6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rftxcrag,005F7043), ref: 005F6F4E
Part of subcall function 005F6F30: GetProcAddress.KERNEL32(00000000), ref: 005F6F55
Part of subcall function 005F6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005F6F7B
Part of subcall function 005F6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005F6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 005FA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005FA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 005FA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 005FA21B
GetDriveTypeA.KERNEL32(?), ref: 005FA265
lstrcat.KERNEL32(?,00000000), ref: 005FA29F
lstrcat.KERNEL32(?,00410A34), ref: 005FA2C5
lstrcat.KERNEL32(?,00000022), ref: 005FA2D9
lstrcat.KERNEL32(?,00410A34), ref: 005FA2F4
wsprintfA.USER32 ref: 005FA31D
lstrcat.KERNEL32(?,00000000), ref: 005FA345
lstrcat.KERNEL32(?,?), ref: 005FA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 005FA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 005FA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005FA1D1

Part of subcall function 005F9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 005F999D
Part of subcall function 005F9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005F99BD
Part of subcall function 005F9966: RegCloseKey.ADVAPI32(?), ref: 005F99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 005FA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 005FA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 005FA41D

Strings

", xrefs: 005FA3F0
D, xrefs: 005FA1F5
\, xrefs: 005F9F73
", xrefs: 005FA2DF
", xrefs: 005FA142
P, xrefs: 005FA011

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: f90b51214536ff5ba74288ddaa6788a4c0881a7a0f28f829f5aadc41c3ec345b
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 0DF131B1D4025DAFDF21DBA09C49EFE7BBCBB08304F1444A5E709E2141E7799A848F66

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6
NtOpenProcessToken, xrefs: 004011D4
RtlInitUnicodeString, xrefs: 00401135
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlNtStatusToDosError, xrefs: 00401194
NtFilterToken, xrefs: 0040122B
RtlSetLastWin32Error, xrefs: 004010D6

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sep, xrefs: 0040B28E
Dec, xrefs: 0040B2A3
Thu, xrefs: 0040B241
Wed, xrefs: 0040B23A
Jul, xrefs: 0040B280
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Apr, xrefs: 0040B26B
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Aug, xrefs: 0040B287
May, xrefs: 0040B272
Feb, xrefs: 0040B25D
Jun, xrefs: 0040B279
Sat, xrefs: 0040B24F
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Tue, xrefs: 0040B233
Sun, xrefs: 0040B225
Mon, xrefs: 0040B22C
Nov, xrefs: 0040B29C

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$D
API String ID: 2976863881-2993797894
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 005F7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 005F7D21
GetUserNameA.ADVAPI32(?,?), ref: 005F7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005F7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 005F7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005F7DC0
EqualSid.ADVAPI32(?,?), ref: 005F7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 005F7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005F7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005F7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 005F7E12
LocalFree.KERNEL32(00000000), ref: 005F7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005F7E35

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 005F7F49, 005F7F76, 005F7F8A, 005F7F8B
D, xrefs: 005F7D73

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$D
API String ID: 2976863881-2993797894
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: f07525e6cc20604ff230c06e1fb49398c6fdf1d4e5c46a99cb316ef664bf1c93
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: F3A13D7190021DAFDB119FA4DD88BFEBFBDFB48300F14806AE605E6150DB798A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
va=%08X%08X uef=%p, xrefs: 00406595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
Jan 13 2018, xrefs: 0040653A
localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
rcpt to:<%s>, xrefs: 0040A855
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
helo %s, xrefs: 0040A803
Incorrect respons, xrefs: 0040AB39
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
quit, xrefs: 0040A86C
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 005F7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005F7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005F7ACD
GetLengthSid.ADVAPI32(?), ref: 005F7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 005F7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005F7B1F
EqualSid.ADVAPI32(?,?), ref: 005F7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 005F7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005F7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005F7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 005F7B77
LocalFree.KERNEL32(00000000), ref: 005F7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005F7B9A
GetAce.ADVAPI32(?,?,?), ref: 005F7BCA
EqualSid.ADVAPI32(?,?), ref: 005F7BF1
DeleteAce.ADVAPI32(?,?), ref: 005F7C0A
EqualSid.ADVAPI32(?,?), ref: 005F7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 005F7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005F7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 005F7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 005F7CE0
LocalFree.KERNEL32(00000000), ref: 005F7CEE

Strings

D, xrefs: 005F7AC3

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: cb6c900d9f1c98eb6c023360f552dba4c4d49eed8afdb5de105dc5bf489a06d7
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: D2813B7190421EABDB11CFA4DD88FEEBFB8BF0C300F14816AE615E6150E7799A41CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$localcfg
API String ID: 237177642-1530340706
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
<, xrefs: 00401378
uac, xrefs: 00401628
, xrefs: 00401462
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
useless, xrefs: 0040161E

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: a0e9a54620e17a19c471557000c2f4691014b1237bb567fcc585c5994024cd6c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: a0e9a54620e17a19c471557000c2f4691014b1237bb567fcc585c5994024cd6c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
kernel32, xrefs: 00401DF7
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
lid_file_upd, xrefs: 00401E25
net_type, xrefs: 00401E87
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 005F858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 005F865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 005F867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 005F86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 005F86B1

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 005F882F, 005F883C, 005F884C
", xrefs: 005F896C

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe
API String ID: 237177642-2177103128
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: dd7e0c9c2fc13ee3119829f2b0a3c34975fc19175cdb5f7581a8b2fb481ea52c
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 61C19EB290010DBEEB11ABA4DD89EFE7FBDFB58300F144465F700E2051EAB94A848B65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 005F14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005F1601
lstrlenW.KERNEL32(-00000003), ref: 005F17D8

Strings

@, xrefs: 005F15E7
<, xrefs: 005F15DF
, xrefs: 005F16C9
D, xrefs: 005F182D

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 1ee684ce89c35ee6e753ef361ff9f807e207956347c1ffc6c250cf0491a6bcc3
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: CFF1AFB1508745DFD720DF64C988BABBBE4FB88300F10892DF69697290D7B8D944CB5A

Function 005F7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005F76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 005F7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 005F778F
___ascii_stricmp.LIBCMT ref: 005F78B4
RegCloseKey.ADVAPI32(?), ref: 005F794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 005F796D
RegCloseKey.ADVAPI32(?), ref: 005F797E
RegCloseKey.ADVAPI32(?), ref: 005F79AC
RegCloseKey.ADVAPI32(?), ref: 005F7A56

Part of subcall function 005FF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,005F772A,?), ref: 005FF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005F79F6
RegCloseKey.ADVAPI32(?), ref: 005F7A4D

Strings

", xrefs: 005F7800

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 77ebde64b93ad353c75a91f6ef63055fea4a0e9f56a2d069e4b1eb9c67846c78
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 3EC1827190410EABDB119BA4DC49FFE7FB9FF49310F1040A5F644E6191EB799A84CB60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 005F2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005F2CED
socket.WS2_32(00000002,00000002,00000011), ref: 005F2D07
htons.WS2_32(00000000), ref: 005F2D42
select.WS2_32 ref: 005F2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 005F2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005F2E62

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 7eb36d097d3881ef56d45226cbd3f4414d54ea7ddded5be8be80b75df218c9a2
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: BE61D0B1508309ABC3209F60DC09B7BBFF8FB88341F104819FB8497251D7B9D8808BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%FROM_EMAIL, xrefs: 0040B3E9
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 005F1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 005F202D
GetSystemInfo.KERNEL32(?), ref: 005F204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 005F206A
GetProcAddress.KERNEL32(00000000), ref: 005F2071
GetCurrentProcess.KERNEL32(?), ref: 005F2082
GetTickCount.KERNEL32 ref: 005F2230

Part of subcall function 005F1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 005F1E7C

Strings

work_srv, xrefs: 005F20C5
flags_upd, xrefs: 005F20A5, 005F20AA, 005F20E3
localcfg, xrefs: 005F2091, 005F2098, 005F20AB, 005F20E4, 005F20F3, 005F2119, 005F2138, 005F214E, 005F2166, 005F2183, 005F219B, 005F21B7, 005F21D7
hi_id, xrefs: 005F217D, 005F2182, 005F219A

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 4eb807b83a2781317ed46168a622f37c900e0325f6c3aa587934fb172b4dd1af
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 555191B050074DAFE320AF658C8AF77BEECFB94704F00491DFA9682152D6BDA944C769

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 005F3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 005F3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 005F3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 005F3095
RtlAllocateHeap.NTDLL(00000000), ref: 005F30B6
htons.WS2_32(00000035), ref: 005F30EF
inet_addr.WS2_32(?), ref: 005F30FA
gethostbyname.WS2_32(?), ref: 005F310D
HeapFree.KERNEL32(00000000), ref: 005F314D

Strings

iphlpapi.dll, xrefs: 005F3062, 005F3067, 005F3077

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 28c77ffafc7d2a64c83b2ceb9db5dd5b507cf1358e21a5c9814c36123211ea41
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: FE318731A0060EABEB119BB49C48EBE7F78BF05760F144165E618E7290DB78DE41CB54

Function 005F958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005F95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005F95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 005F95DC
wsprintfA.USER32 ref: 005F9635
wsprintfA.USER32 ref: 005F9673
wsprintfA.USER32 ref: 005F96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 005F9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005F978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005F97D8

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 7e12a67df7d257f43d5a0e8c8b4f4089f24191dcc0d8fdbfaf36d626f8fde2dc
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: D7A170B190060DEBEB21EFA0CC49FEA3FACFB45740F104026FA1596151E7B9D984CBA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 005F6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005F67C3
htonl.WS2_32(?), ref: 005F67DF
htonl.WS2_32(?), ref: 005F67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005F68F1
ExitProcess.KERNEL32 ref: 005F69BC

Strings

except_info, xrefs: 005F698F
localcfg, xrefs: 005F6994

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: cc3be65694bdd9221a82fa58b1b2846e441fb8b797f0b2d288f2be0954f3c562
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 69616071940208AFDB609FB4DC45FEA7BE9FF48300F14806AFA6DD2161DAB59990CF54

Function 005FF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(005FCC84), ref: 005FF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 005FF5CE
closesocket.WS2_32(00000000), ref: 005FF5DC

Strings

time_cfg, xrefs: 005FF58A

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 65cb0304a9ead31711ef45e4eef9f089d35efe6f0ff2c71945dbe963592d3487
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 02314B7290011DABDB109FA5EC899EF7BBCFF88310F104566FA15D3150EB749A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 005F2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 005F2FA1
LoadLibraryA.KERNEL32(?), ref: 005F2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 005F2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005F3000
RtlAllocateHeap.NTDLL(00000000), ref: 005F3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 005F3032

Strings

dnsapi.dll, xrefs: 005F2F90

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 6e4bebfaa78a162eaf0f1b2bee331d1bdbe49a020d7fbf40df2c77effd4ebf30
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: D521317194162AEBDB219B55DC499BEBFBCFF08B50F104421FA05E7140D7B89A8187D4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 005F99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 005F9A18
GetThreadContext.KERNEL32(?,?), ref: 005F9A52
TerminateProcess.KERNEL32(?,00000000), ref: 005F9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 005F9A98
SetThreadContext.KERNEL32(?,00010002), ref: 005F9AB5
ResumeThread.KERNEL32(?), ref: 005F9AC2

Strings

D, xrefs: 005F9A10

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 02b8497f8199d2bddf8f0bf061fdbde998c3a6ca4a016353ae8877bbf4a58345
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 7F211971901119BBDB219BA1DC09EEFBFBCEF04750F404061BA19E1150EA758A84CAA4

Function 005F1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 005F1C18
LoadLibraryA.KERNEL32(004102C8), ref: 005F1C26
GetProcessHeap.KERNEL32 ref: 005F1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 005F1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 005F1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 005F1D02
FreeLibrary.KERNEL32(?), ref: 005F1D0B

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 41dbf5b38a8b6fcf061f4414cfddd7d377b699146aa7d8bddfe3eaf24b5f74e8
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: FB311D31D0065DEFCB119FA4DC888BEBFB9FB45751B24447AE601E6110D7B94E80DB98

Function 005F6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 005F6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 005F6D22
GetLastError.KERNEL32 ref: 005F6DA7
CloseHandle.KERNEL32(?), ref: 005F6DB5
GetLastError.KERNEL32 ref: 005F6DD6
DeleteFileA.KERNEL32(?), ref: 005F6DE7
GetLastError.KERNEL32 ref: 005F6DFD

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: a55903d658681f225e11a726248d28e4c52e9f655831273052e500068c568db1
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2131EE76A0024DBFCB019FA49D49AEF7F79FB88300F148565E311E3221D7748A858B61

Function 005F6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rftxcrag,005F7043), ref: 005F6F4E
GetProcAddress.KERNEL32(00000000), ref: 005F6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005F6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005F6F92

Strings

C:\Windows\SysWOW64\, xrefs: 005F6F30, 005F6F38, 005F6F65, 005F6F6C, 005F6F7A, 005F6F85, 005F6F91, 005F6FA9, 005F6FC6, 005F6FEC
\\.\pipe\rftxcrag, xrefs: 005F6F37

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\rftxcrag
API String ID: 1082366364-666812975
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: ce315f71f48a5ba712b8de31b18a05e67e724aed6281589f66009ec13e9d8a40
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: BE21312174134D7AF3225330AC8DFFB2E4CAF96720F0840A5F600E6592DADD88D6C2AD

Function 005FAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 005FAAE5

Strings

localcfg, xrefs: 005FAD72
, xrefs: 005FABB3

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 02e76b63e47d78e53e8f277c7e1c015ec2e135456a7076a562dbcd44bd541472
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: D77116F1A4030DAADF219A54DC8ABFE3F69BB40345F244426FB0DA6091DB6E8D848757

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 005FE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005FDF6C: GetCurrentThreadId.KERNEL32 ref: 005FDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 005FE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,005F6128), ref: 005FE950
lstrcmp.KERNEL32(?,00000008), ref: 005FE989

Strings

A, xrefs: 005FE8C6, 005FE8CD, 005FE936, 005FE998
A, xrefs: 005FE960, 005FE965
A, xrefs: 005FE9A0

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 64aef65ee3716fb073030091fbba92defc22e6a57776ae0b1967515457a96c7b
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B031903160070D9BDB718F24C98ABBA7FE5FB55720F10892AF75587561D3B8E880CBA1

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 005F6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 005F6E19

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 2fd8dd7f18a45043bb7dd4bd753414e55af6c299bf7a9c3f8227a14bdb4970d4
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 66214D7720411DBFDB109B60FC49EEF7FADEB49360B208425F702D1091EB799A409674

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 005F92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005F92E2
wsprintfA.USER32 ref: 005F9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005F9375
lstrlen.KERNEL32(?,?,00000000), ref: 005F9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 005F9394
CloseHandle.KERNEL32(00000000), ref: 005F939B

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 9317a40d8a9fb2a86f53fe4eef57991c59a5d2f97d87d79aaf19ff5450343425
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 901172B66401197BE7216731EC0EFFF3E6DEFC8B10F008065BB09A6091EAB84A418665

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 005FC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005FC6B4
InterlockedIncrement.KERNEL32(005FC74B), ref: 005FC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,005FC747), ref: 005FC728
CloseHandle.KERNEL32(00000000,?,005FC747,00413588,005F8A77), ref: 005FC733

Strings

localcfg, xrefs: 005FC544

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: b4b824d724612763a758cfbc63356924f2291c74374ac0eb13529adb4031e2ae
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 5C513FB1A05B498FD7249F69C6C5526BFE9FB88300B50593EE28BC7A90D778F844CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe
API String ID: 124786226-3652848383
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 005FE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,005FE50A,00000000,00000000,00000000,00020106,00000000,005FE50A,00000000,000000E4), ref: 005FE319
RegSetValueExA.ADVAPI32(005FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005FE38E
RegDeleteValueA.ADVAPI32(005FE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D_), ref: 005FE3BF
RegCloseKey.ADVAPI32(005FE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D_,005FE50A), ref: 005FE3C8

Strings

D_, xrefs: 005FE2FC

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: D_
API String ID: 2667537340-2347782904
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 1b7ffa3c550cd6f021caa655ed7ef598f7e57bdebd60be57299fd8b8e863e7b0
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 84218031A0021DBBDF209FA4EC8AEEE7F78EF08750F048431FA04E6061E2719A54D790

Function 005F71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005F71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005F7228
LocalFree.KERNEL32(?,?,?), ref: 005F7286
wsprintfA.USER32 ref: 005F729D

Strings

|, xrefs: 005F721A

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: ffe9d0e9c240da61aecada4a404fc0b974d8b2c03a95d54ddad8ec55c0544eeb
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 84310B7690410DBBDB01DFA8DC49AEA7FACFF08314F148066F959DB101EB79D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 005FB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005FB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005FB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 005FB548
GetTimeZoneInformation.KERNEL32(?), ref: 005FB590
wsprintfA.USER32 ref: 005FB61E

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 0eed2b768c2e57acbf72b574aa4d5fac5d78c0c25fe765ccd4f5ff1692b861c8
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 76511DB1D0021DEADF14DFD5D8895FEBBB9BF48304F10852AE601A6150E7B84AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 005F62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005F6303
LoadLibraryA.KERNEL32(?), ref: 005F632A
GetProcAddress.KERNEL32(00000000,?), ref: 005F63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005F6405

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 9350fc3384c7618129940a482112ed808e8824c63ec28b52c3226e01b141ac8c
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 67416C71A0020EEFDB14CF58C884AB9BBB8FF04358F248969EA15D7290E779ED40DB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 005F93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005F93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 005F93CD
CharToOemA.USER32(?,?), ref: 005F93DB
wsprintfA.USER32 ref: 005F9410

Part of subcall function 005F92CB: GetTempPathA.KERNEL32(00000400,?), ref: 005F92E2
Part of subcall function 005F92CB: wsprintfA.USER32 ref: 005F9350
Part of subcall function 005F92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005F9375
Part of subcall function 005F92CB: lstrlen.KERNEL32(?,?,00000000), ref: 005F9389
Part of subcall function 005F92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 005F9394
Part of subcall function 005F92CB: CloseHandle.KERNEL32(00000000), ref: 005F939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 005F9448

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: b35f7be51367398d91a706b838e8596f89ae3bd0e01bcffb72c1512c8842c02b
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 600152F69001197BDB21A7619D4DFEF3B7CEB95701F0040A1BB49E2080EAB896C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 005F28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005F28FA
gethostbyname.WS2_32(u6A), ref: 005F2906

Strings

time_cfg, xrefs: 005F28EB
u6A, xrefs: 005F28EC, 005F28F9, 005F2905

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: fec5bf796ca797894756f1667621db095f25e0209a1351d721d1571ef19b702b
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 82E0C7306082218FCB008B2CF848AEA3BE4FF0A330F008180F180C32A2C778DCC0AB80

Function 005F69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005F69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 005F6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 005F6A3A
CloseHandle.KERNEL32(000000FF), ref: 005F6BD8

Part of subcall function 005FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005F1DCF,?), ref: 005FEEA8
Part of subcall function 005FEE95: HeapFree.KERNEL32(00000000), ref: 005FEEAF

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: c02441fa22aecc5a2d975fedce49d3c3861348177a7c8a88a0749f0d8f9c70a2
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: D171157190021DEFDB109FA4CD85AFEBFB9FB04314F10456AEA15E6190D7389E92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 005F417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005F41AB
GetLastError.KERNEL32 ref: 005F41B5
WaitForSingleObject.KERNEL32(?,?), ref: 005F41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F41D9

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 5569af926d0707c4ad44251ac59c7278ff49bcb9d0fe7bc9924661cae7ca75a9
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: A701927691110EABDB01DF91ED84BEB7BA8BB18355F108461FA01E2050D774AAA4CBA6

Function 005F41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005F421F
GetLastError.KERNEL32 ref: 005F4229
WaitForSingleObject.KERNEL32(?,?), ref: 005F423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005F424D

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 31f8dac4be47e35367be13c990cfbf1cc3648be7ced4230639fabc521db5127f
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: EA019072911209ABDF01DF90EE84BEF7BACFB08356F108461FA01E2050D774AA549BA6

Function 005FE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 005FE066

Strings

A, xrefs: 005FE037, 005FE03C
A, xrefs: 005FE036
A, xrefs: 005FE07F

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: a3a973a1b34d371441ab2d6a7e08cc8fed27dec50f9177626367e3d8274b0535
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 24F06831200705DBCB20CF15D888992BBEDFB05321B548B2AE254C3070D7B8A895CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 005FE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,D_,00000000,00000000,00000000), ref: 005FE470
CloseHandle.KERNEL32(00000001,00000003), ref: 005FE484

Part of subcall function 005FE2FC: RegCreateKeyExA.ADVAPI32(80000001,005FE50A,00000000,00000000,00000000,00020106,00000000,005FE50A,00000000,000000E4), ref: 005FE319
Part of subcall function 005FE2FC: RegSetValueExA.ADVAPI32(005FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005FE38E
Part of subcall function 005FE2FC: RegDeleteValueA.ADVAPI32(005FE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D_), ref: 005FE3BF
Part of subcall function 005FE2FC: RegCloseKey.ADVAPI32(005FE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D_,005FE50A), ref: 005FE3C8

Strings

D_, xrefs: 005FE498, 005FE4BD, 005FE41A, 005FE447, 005FE4C0, 005FE41D, 005FE459, 005FE45A, 005FE46C, 005FE49B

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: D_
API String ID: 4151426672-2347782904
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 44c35db9b710ac2ff0210992c75c6d7255ab76122710944bfd6a9c602fd7c56e
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: A541ACB190021DBAEB206A558C4BFFF3F6CFB44714F148025FB09941A2E7B98A50DA75

Function 005F8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005F83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 005F8477

Part of subcall function 005F69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 005F69E5
Part of subcall function 005F69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 005F6A26
Part of subcall function 005F69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 005F6A3A

Part of subcall function 005FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005F1DCF,?), ref: 005FEEA8
Part of subcall function 005FEE95: HeapFree.KERNEL32(00000000), ref: 005FEEAF

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 005F848C, 005F84A1

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe
API String ID: 359188348-3652848383
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 0e85419026b02a645d4c09781bf51602d2d5860d7c4f6b477b95420cf8204464
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: A3414FB290010EBEEF10EBA49E89DFF7F6CFB44344F144466E704D6151EAB85A988B64

Function 005FAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005FAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 005FB00D

Part of subcall function 005FAF6F: gethostname.WS2_32(?,00000080), ref: 005FAF83
Part of subcall function 005FAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 005FAFE6

Part of subcall function 005F331C: gethostname.WS2_32(?,00000080), ref: 005F333F
Part of subcall function 005F331C: gethostbyname.WS2_32(?), ref: 005F3349

Part of subcall function 005FAA0A: inet_ntoa.WS2_32(00000000), ref: 005FAA10

Strings

%OUTLOOK_BND_, xrefs: 005FB076, 005FB07B, 005FB0BE, 005FB0DD

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: f0e55b135e103e88dc87df0b1f7f7f0bfb3ab1e31362ba1612af1a1613352e87
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 1941327290020DABDB25EFA0DC4AEEF3B6CFF44304F144426FA2592152EB79E654CB55

Function 005F9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 005F9536
Sleep.KERNEL32(000001F4), ref: 005F955D

Strings

, xrefs: 005F94D9

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 19163c3522f35391a353d57a832c5d40218fa1b851af3b631b86050d5599ed4c
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 134125B1C0878D6EEF378B68D89D7B67FA4BF52314F2800A5D682971A2D6BC4D818711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 005FBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005FB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 005FBA3A
InterlockedIncrement.KERNEL32(?), ref: 005FBA94
GetTickCount.KERNEL32 ref: 005FBB79
GetTickCount.KERNEL32 ref: 005FBB99
InterlockedIncrement.KERNEL32(?), ref: 005FBE15
closesocket.WS2_32(00000000), ref: 005FBEB4

Strings

%FROM_EMAIL, xrefs: 005FBC7D

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: fcc3de7754ce5ac75bff224aa67382dc8c9dc4b1def7626520a27760dcdb3a9d
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 79314B7150024CDFEF25DFA4DC89AF97BA8FB48700F204456FB2482161EB79DA85CB15

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 005F709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005F70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005F70F4

Strings

|, xrefs: 005F70E6

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: ec50d017694d84dfb9097ee4891731fa1700a396d11bf6f78b8f198b39f97e4a
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 8D11097290411CEBDF21CFE4DC84EEEBBBDBB08711F1441A6E601E6190D6749B88DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00409961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(hvjnshqw,Function_00009867), ref: 0040996C

Part of subcall function 00409892: SetServiceStatus.SECHOST(00413394), ref: 004098EB

Part of subcall function 004098F2: Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Strings

hvjnshqw, xrefs: 00409967, 004099AD
Xd|, xrefs: 00409974, 004099BA

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Service$CtrlHandlerRegisterSleepStatus
String ID: Xd|$hvjnshqw
API String ID: 1317371667-1444363091
Opcode ID: ca430b9e4608bea333335a69787ed6bca2f17ce8de0e46e285fa1f472da398df
Instruction ID: 8090f714d00e8c700c7feefac428721607cdcb0429ac14865b211bf96103553c
Opcode Fuzzy Hash: ca430b9e4608bea333335a69787ed6bca2f17ce8de0e46e285fa1f472da398df
Instruction Fuzzy Hash: 55F054F2550308AEE2106F616D87B537548A711349F08C03FB919693D3EBBD4D44822D

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2134431058.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 005F3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005F2F88: GetModuleHandleA.KERNEL32(?), ref: 005F2FA1
Part of subcall function 005F2F88: LoadLibraryA.KERNEL32(?), ref: 005F2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005F31DA
HeapFree.KERNEL32(00000000), ref: 005F31E1

Memory Dump Source

Source File: 0000000C.00000002.2134570689.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5f0000_xnjytljr.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: cad2dbf37db1abde54b8ee389ff4aad75ca83dc0808490cf1729895b043aaf9d
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 1751BA7590020AAFDF01DF64D8889FABB79FF15300F244568EE96C7211EB36DA19CB90

Analysis Process: svchost.exePID: 2244, Parent PID: 6788COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02B4C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02B4CA4E
closesocket.WS2_32(?), ref: 02B4CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02B4CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B4CCB4
WriteFile.KERNEL32(02B4A4B3,?,-000000E8,?,00000000), ref: 02B4CCDC
CloseHandle.KERNEL32(02B4A4B3), ref: 02B4CCED
wsprintfA.USER32 ref: 02B4CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B4CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02B4CD89
CloseHandle.KERNEL32(?), ref: 02B4CD98
CloseHandle.KERNEL32(?), ref: 02B4CD9D
DeleteFileA.KERNEL32(?), ref: 02B4CDC4
CloseHandle.KERNEL32(02B4A4B3), ref: 02B4CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B4CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B4CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B4D033
lstrcatA.KERNEL32(?,04300108), ref: 02B4D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02B4D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02B4D171
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000), ref: 02B4D195
CloseHandle.KERNEL32(00000000), ref: 02B4D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02B4D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B4D231
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02B4D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B4D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D2C7
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B4D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B4D372
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02B4D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B4D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D408
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B4D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B4D45B
CreateProcessA.KERNEL32(?,02B50264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B4D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B4D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B4D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B4D513
closesocket.WS2_32(?), ref: 02B4D56C
Sleep.KERNEL32(000003E8), ref: 02B4D577
ExitProcess.KERNEL32 ref: 02B4D583
wsprintfA.USER32 ref: 02B4D81F

Part of subcall function 02B4C65C: send.WS2_32(00000000,?,00000000), ref: 02B4C74B

closesocket.WS2_32(?), ref: 02B4DAD5

Strings

flags_upd, xrefs: 02B4CE4A
wtm_w, xrefs: 02B4C96C
\, xrefs: 02B4D39D
work_srv, xrefs: 02B4D607, 02B4D60F, 02B4D62C
drivers\, xrefs: 02B4D067
lid_file_upd, xrefs: 02B4CE6A
except_info, xrefs: 02B4D8CD, 02B4D8D2, 02B4D8FB
@, xrefs: 02B4D754
time_cfg, xrefs: 02B4C95B, 02B4C962, 02B4C971, 02B4C984
\, xrefs: 02B4D3A7
localcfg, xrefs: 02B4CA89, 02B4CA93, 02B4CAC0, 02B4CAD2, 02B4CE4F, 02B4CE6F, 02B4D8D3, 02B4D8FC
srv_time, xrefs: 02B4CABB
wtm_r, xrefs: 02B4C97F
C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 02B4CC10, 02B4CCF3, 02B4D975, 02B4D98E
.sys, xrefs: 02B4D0CC
local_time, xrefs: 02B4CACD
wtm_c, xrefs: 02B4C956
4, xrefs: 02B4D9F7
.dat, xrefs: 02B4D0D7, 02B4D138, 02B4D1AE, 02B4D1D4, 02B4D28E, 02B4D308, 02B4D3CF, 02B4D441

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3621667711
Opcode ID: 422215d5e9b445ccea170446b1cc6589abf453908a2a0b245618dd5022f61b23
Instruction ID: 0878570aa57d913443d5c12239f785d8be38b312c7d5efca7d23595b6c6418c8
Opcode Fuzzy Hash: 422215d5e9b445ccea170446b1cc6589abf453908a2a0b245618dd5022f61b23
Instruction Fuzzy Hash: EFB2B471D41219ABEB11AFA4DCC4FEA7BB9EB08344F1408EAFA45AB140DF309955EF50

Function 02B49A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02B49A7F
SetErrorMode.KERNELBASE(00000003), ref: 02B49A83
SetUnhandledExceptionFilter.KERNEL32(02B46511), ref: 02B49A8A

Part of subcall function 02B4EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B4EC5E
Part of subcall function 02B4EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B4EC72
Part of subcall function 02B4EC54: GetTickCount.KERNEL32 ref: 02B4EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02B49AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02B49ABA
GetCommandLineA.KERNEL32 ref: 02B49AFD
lstrlenA.KERNEL32(?), ref: 02B49B99
ExitProcess.KERNEL32 ref: 02B49C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02B49CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02B49D7A
lstrcatA.KERNEL32(?,?), ref: 02B49D8B
lstrcatA.KERNEL32(?,02B5070C), ref: 02B49D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B49DED
DeleteFileA.KERNEL32(00000022), ref: 02B49E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02B49E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B49EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B49ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02B49F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02B49F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02B49F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02B49FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B49FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B49FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02B4A038
lstrcatA.KERNEL32(00000022,02B50A34), ref: 02B4A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02B4A072
lstrcatA.KERNEL32(00000022,02B50A34), ref: 02B4A08D
wsprintfA.USER32 ref: 02B4A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02B4A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02B4A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02B4A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B4A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02B4A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02B4A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02B4A1B6
GetCommandLineA.KERNEL32 ref: 02B4A1E5

Part of subcall function 02B499D2: lstrcpyA.KERNEL32(?,?,00000100,02B522F8,00000000,?,02B49E9D,?,00000022,?,?,?,?,?,?,?), ref: 02B499DF
Part of subcall function 02B499D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02B49E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02B49A3C
Part of subcall function 02B499D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02B49E9D,?,00000022,?,?,?), ref: 02B49A52

lstrlenA.KERNEL32(?), ref: 02B4A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02B4A3B7
GetLastError.KERNEL32 ref: 02B4A3ED
Sleep.KERNELBASE(000003E8), ref: 02B4A400
DeleteFileA.KERNELBASE(02B533D8), ref: 02B4A407
CreateThread.KERNELBASE(00000000,00000000,02B4405E,00000000,00000000,00000000), ref: 02B4A42C
WSAStartup.WS2_32(00001010,?), ref: 02B4A43A
CreateThread.KERNELBASE(00000000,00000000,02B4877E,00000000,00000000,00000000), ref: 02B4A469
Sleep.KERNELBASE(00000BB8), ref: 02B4A48A
GetTickCount.KERNEL32 ref: 02B4A49F
GetTickCount.KERNEL32 ref: 02B4A4B7
Sleep.KERNELBASE(00001A90), ref: 02B4A4C3

Strings

D, xrefs: 02B49F8E
C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 02B4A1D9
%X%08X, xrefs: 02B4A0B0
", xrefs: 02B49EDB
", xrefs: 02B4A078
hvjnshqw, xrefs: 02B4A389, 02B4A397
P, xrefs: 02B49DAA
\, xrefs: 02B49D0C
", xrefs: 02B4A189

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$D$P$\$hvjnshqw
API String ID: 2089075347-328042157
Opcode ID: c105976aeec4b8c14db6535d801f6a973561c3ab4a9dfa2d9d169958dc3c1095
Instruction ID: cd6a24e049f50b25a88e5b1c59d26042a73eafa198dd3d48c84c0e660e3dae30
Opcode Fuzzy Hash: c105976aeec4b8c14db6535d801f6a973561c3ab4a9dfa2d9d169958dc3c1095
Instruction Fuzzy Hash: 195252B1D80259ABEB11ABA08CC9FEF7BBDEB09304F1448E5F505A7141EF709A449F61

Function 02B4199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02B419B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02B41E9E), ref: 02B419BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02B419E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02B419ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02B419F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02B41E9E), ref: 02B41A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02B41E9E), ref: 02B41A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02B41E9E), ref: 02B41A36
GetAdaptersInfo.IPHLPAPI(00000000,02B41E9E,?,?,?,?,00000001,02B41E9E), ref: 02B41A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02B41E9E,?,?,?,?,00000001,02B41E9E), ref: 02B41A5A
GetAdaptersInfo.IPHLPAPI(00000000,02B41E9E,?,?,?,?,00000001,02B41E9E), ref: 02B41A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02B41E9E), ref: 02B41A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02B41E9E), ref: 02B41AA4

Strings

GetBestInterface, xrefs: 02B419EF
123.45.67.89, xrefs: 02B419A6
GetAdaptersInfo, xrefs: 02B419DC
GetIfEntry, xrefs: 02B419E4
localcfg, xrefs: 02B419A3
Iphlpapi.dll, xrefs: 02B419B7

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 602728940618d11f355f5d5a102416bce9d0f098da8b2cc0599a41ffe1c94da1
Instruction ID: 8f459262db2830feb4d9cc886b6546fc3557bf513d21fabdddef0d05c598d27b
Opcode Fuzzy Hash: 602728940618d11f355f5d5a102416bce9d0f098da8b2cc0599a41ffe1c94da1
Instruction Fuzzy Hash: D231A631D10219AFDF11AFE8CCC89BEBBB5EF48745B1449BAF625A7110DB304980DB61

Function 02B47A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02B47ABA
GetUserNameA.ADVAPI32(?,?), ref: 02B47ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02B5070C,?,?,?), ref: 02B47B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02B47B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02B47B59
EqualSid.ADVAPI32(?,00000022), ref: 02B47B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B47B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B47B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B47B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02B47BAB
LocalFree.KERNEL32(00000000), ref: 02B47BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02B47FC9,?,00000000), ref: 02B47BCE

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 02B47CE2, 02B47D0F, 02B47D23, 02B47D24
D, xrefs: 02B47B0C

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$D
API String ID: 2976863881-2993797894
Opcode ID: 70cf46c28d26d544394030d6600ff0dc125b3e0e2b10d6e0c98e560d0e70afb8
Instruction ID: a7bbe4043b30c736b0483aa0f2a0bdf67a6aad461655d0c4d0af6b2d1aa6c72f
Opcode Fuzzy Hash: 70cf46c28d26d544394030d6600ff0dc125b3e0e2b10d6e0c98e560d0e70afb8
Instruction Fuzzy Hash: 78A14CB1D40229AFDF119FA0CC88FEEBBB9FF08344F1444A9E905E6140DB359A55EB60

Function 02B47809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02B4782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B47866
GetLengthSid.ADVAPI32(?), ref: 02B47878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02B4789A
GetSecurityDescriptorOwner.ADVAPI32(?,02B47F63,?), ref: 02B478B8
EqualSid.ADVAPI32(?,02B47F63), ref: 02B478D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B478E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B478F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B47901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02B47910
LocalFree.KERNEL32(00000000), ref: 02B47917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02B47933
GetAce.ADVAPI32(?,00000000,?), ref: 02B47963
EqualSid.ADVAPI32(?,02B47F63), ref: 02B4798A
DeleteAce.ADVAPI32(?,00000000), ref: 02B479A3
EqualSid.ADVAPI32(?,02B47F63), ref: 02B479C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B47A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B47A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02B47A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02B47A79
LocalFree.KERNEL32(00000000), ref: 02B47A87

Strings

D, xrefs: 02B4785C

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: d282f1791c86e0965d710be602b06322070cf377085ba6c060aa3f3bc9d952f7
Instruction ID: 4a05408ab7d6821a16cc6d94bf15e0e0650ade0b3b567735374c6213b5ce36c6
Opcode Fuzzy Hash: d282f1791c86e0965d710be602b06322070cf377085ba6c060aa3f3bc9d952f7
Instruction Fuzzy Hash: 34813C71D0021EABDF21DFA4CD84FEEBBB8EF08344F1445AAE615E6140DB349651EB64

Function 02B48328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02B50750,?,?,00000000,localcfg,00000000), ref: 02B483F3
RegQueryValueExA.KERNELBASE(02B50750,?,00000000,?,02B48893,?,?,?,00000000,00000103,02B50750,?,?,00000000,localcfg,00000000), ref: 02B48414
RegSetValueExA.KERNELBASE(02B50750,?,00000000,00000004,02B48893,00000004,?,?,00000000,00000103,02B50750,?,?,00000000,localcfg,00000000), ref: 02B48441
RegCloseKey.ADVAPI32(02B50750,?,?,00000000,00000103,02B50750,?,?,00000000,localcfg,00000000), ref: 02B4844A

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 02B485C8, 02B485D5, 02B485E5
localcfg, xrefs: 02B48348

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe$localcfg
API String ID: 237177642-1530340706
Opcode ID: 958b4bad9ec467169d8abdb61001f3b34c1b51612b218c54b28f6d6b137c57f0
Instruction ID: 328ffa08f4173ea906dc9d3aefcc2b35c5ca875f36cbca4a2cae2ac9b36947bd
Opcode Fuzzy Hash: 958b4bad9ec467169d8abdb61001f3b34c1b51612b218c54b28f6d6b137c57f0
Instruction Fuzzy Hash: 21C1A3B1D80258BEEB11ABA4DCC4FEE7BBDEB08344F1448A5F905A6041DF309A54EF21

Function 02B41D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02B41DC6
GetSystemInfo.KERNELBASE(?), ref: 02B41DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02B41E03
GetProcAddress.KERNEL32(00000000), ref: 02B41E0A
GetCurrentProcess.KERNEL32(?), ref: 02B41E1B
GetTickCount.KERNEL32 ref: 02B41FC9

Part of subcall function 02B41BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02B41C15

Strings

flags_upd, xrefs: 02B41E3E, 02B41E43, 02B41E7C
work_srv, xrefs: 02B41E5E
net_type, xrefs: 02B41E87
hi_id, xrefs: 02B41F16, 02B41F1B, 02B41F33
lid_file_upd, xrefs: 02B41E25
IsWow64Process, xrefs: 02B41DF2
start_srv, xrefs: 02B41E6C
born_date, xrefs: 02B41EAD, 02B41ECC
kernel32, xrefs: 02B41DF7
localcfg, xrefs: 02B41E2A, 02B41E31, 02B41E44, 02B41E7D, 02B41E8C, 02B41EB2, 02B41ED1, 02B41EE7, 02B41EFF, 02B41F1C, 02B41F34, 02B41F50, 02B41F70
loader_id, xrefs: 02B41F4B, 02B41F6B

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: f3b94434b9e12f81b703693de42d749b8de825906322d4442902b5b53bcd73a9
Instruction ID: d2046aa55f77429c25b183e85cc1aa2aeea8070674127bb380b8c6740b24ab34
Opcode Fuzzy Hash: f3b94434b9e12f81b703693de42d749b8de825906322d4442902b5b53bcd73a9
Instruction Fuzzy Hash: D151B1B09043446FE720AF698CC5B27BBECFF48748F044D9DB99A86102DB74A944DB61

Function 02B473FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 02B47472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 02B474F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 02B47528
___ascii_stricmp.LIBCMT ref: 02B4764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 02B476E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02B47706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 02B47717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 02B47745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 02B477EF

Part of subcall function 02B4F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B522F8,000000C8,02B47150,?), ref: 02B4F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B4778F
RegCloseKey.KERNELBASE(?), ref: 02B477E6

Strings

", xrefs: 02B47599

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 4237623234efde6de7c1450c94bef7f1ee0864f803a8d34f4e8c11de046b54e6
Instruction ID: 13a2b251379c2597173a45cbeaf668f8b4becdcddaef29ac4fbc703061a96318
Opcode Fuzzy Hash: 4237623234efde6de7c1450c94bef7f1ee0864f803a8d34f4e8c11de046b54e6
Instruction Fuzzy Hash: 4DC18072940219AFEB119BA4DC84FEEBBBAEF49314F1404D5E504EA190EF71DA44EF60

Function 02B4675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 02B4677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 02B4679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 02B467B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 02B467BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 02B467D3
ReadFile.KERNELBASE(000000FF,?,00000040,02B48244,00000000,?,76230F10,00000000), ref: 02B46807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02B4681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 02B4683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02B4685C
ReadFile.KERNEL32(000000FF,?,00000028,02B48244,00000000,?,76230F10,00000000), ref: 02B4688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 02B46906
ReadFile.KERNEL32(000000FF,?,00000000,02B48244,00000000,?,76230F10,00000000), ref: 02B4691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,76230F10,00000000), ref: 02B46971

Part of subcall function 02B4EC2E: GetProcessHeap.KERNEL32(00000000,02B4EA27,00000000,02B4EA27,00000000), ref: 02B4EC41
Part of subcall function 02B4EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B4EC48

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 3a2a29440ef59338e2aabe8dbf96377f5384a942e1f9bbb8f3a7610adfd0ca0d
Instruction ID: 881d588990ba7387ff9470b8d482280fb80c97fc0ed56f0d79af4eeaec4b3eeb
Opcode Fuzzy Hash: 3a2a29440ef59338e2aabe8dbf96377f5384a942e1f9bbb8f3a7610adfd0ca0d
Instruction Fuzzy Hash: 94711A71C0021DEFDF159FA4CC80AEEBBB9FB09354F1045AAE915A6190EB709E51DF60

Function 02B4F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02B4CA1D), ref: 02B4F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02B4F367
closesocket.WS2_32(00000000), ref: 02B4F375

Strings

time_cfg, xrefs: 02B4F323

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 13075661d18220e2419dbf1d90ad3b41f135aeea6a7d4dd721f4f6b875a13605
Instruction ID: 0e6a6ca7770c430a1dd3efc41848cdaa4036fdd4728207023e1c73d054d3bb3a
Opcode Fuzzy Hash: 13075661d18220e2419dbf1d90ad3b41f135aeea6a7d4dd721f4f6b875a13605
Instruction Fuzzy Hash: AF317C72940229ABDB11EFA5DC84EFE7BBCFF88354F1045A6F915D3140EB309A419BA1

Function 02B4405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02B44070
ExitProcess.KERNEL32 ref: 02B44121

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 8f974cec1afe8a3e76f9639031307bfdfc2d6018746e646bf1722f7aca49e3e2
Instruction ID: cc092eb57ea3f204d82a8a57b71716fe13bc8ddb138c3700c16e2970259ffcc1
Opcode Fuzzy Hash: 8f974cec1afe8a3e76f9639031307bfdfc2d6018746e646bf1722f7aca49e3e2
Instruction Fuzzy Hash: 8F5180B1D40219BAEF10ABA08CC5FBF7ABDEF15754F1405A5FA00B6180EB308A55EB61

Function 02B42D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,02B42F01,?,02B420FF,02B52000), ref: 02B42D3A
LoadLibraryA.KERNEL32(?), ref: 02B42D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02B42D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02B42D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02B42D99
HeapAlloc.KERNEL32(00000000), ref: 02B42DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02B42DCB

Strings

DnsQuery_A, xrefs: 02B42D5B
dnsapi.dll, xrefs: 02B42D29

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 56565858223b6bc430b477d36da5f0c40bdbf179213f9464e5e9eb8f7732f06c
Instruction ID: 67f80598e68c5e8a03b22c62ce66262f09b92b8b108045ace1b1bebea96030e9
Opcode Fuzzy Hash: 56565858223b6bc430b477d36da5f0c40bdbf179213f9464e5e9eb8f7732f06c
Instruction Fuzzy Hash: 7C215171940625BBCB11AF64DC84BAEBBB9EF08B50F104892FD05E7100DB709985A7D0

Function 02B480C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02B4815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02B4A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02B48187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02B4A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02B481BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02B48210

Part of subcall function 02B4675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 02B4677E
Part of subcall function 02B4675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 02B4679A
Part of subcall function 02B4675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 02B467B0
Part of subcall function 02B4675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 02B467BF
Part of subcall function 02B4675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 02B467D3
Part of subcall function 02B4675C: ReadFile.KERNELBASE(000000FF,?,00000040,02B48244,00000000,?,76230F10,00000000), ref: 02B46807
Part of subcall function 02B4675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02B4681F
Part of subcall function 02B4675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 02B4683E
Part of subcall function 02B4675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02B4685C

Part of subcall function 02B4EC2E: GetProcessHeap.KERNEL32(00000000,02B4EA27,00000000,02B4EA27,00000000), ref: 02B4EC41
Part of subcall function 02B4EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B4EC48

Strings

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe, xrefs: 02B48225, 02B4823A

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe
API String ID: 124786226-3652848383
Opcode ID: 8153ce24506975403f99d58366551f4252beb6bc69e04db03333c3d463292174
Instruction ID: 42485b55b78f813b73a68c9757d6f9281b4a2c5f9535b733728f428eda458037
Opcode Fuzzy Hash: 8153ce24506975403f99d58366551f4252beb6bc69e04db03333c3d463292174
Instruction Fuzzy Hash: F04174B2D45219BFEB11EB949DC0EBE776DEB04344F1408E6ED41A7100EF705A54AB51

Function 02B41AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B41AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B41AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B41B20

Strings

GetAdaptersAddresses, xrefs: 02B41AE3
Iphlpapi.dll, xrefs: 02B41ACC

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 8b89f82fd7eafd8000db2df98caef8006d46962de8e56544c731812f190c3bbb
Instruction ID: bb0e520706da5814f674330ce3b38b2e98ce7d943ea8f7263fcbcdc6cc175cf2
Opcode Fuzzy Hash: 8b89f82fd7eafd8000db2df98caef8006d46962de8e56544c731812f190c3bbb
Instruction Fuzzy Hash: C111D671E11238BFDB119BACDCC49EDBBBAEB48B54B1444D5E009E7100EB304A80EB94

Function 02B4E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02B4E5F2,00000000,00020119,02B4E5F2,02B522F8), ref: 02B4E3E6
RegQueryValueExA.ADVAPI32(02B4E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02B4E44E
RegQueryValueExA.ADVAPI32(02B4E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02B4E482
RegQueryValueExA.ADVAPI32(02B4E5F2,?,00000000,?,80000001,?), ref: 02B4E4CF
RegCloseKey.ADVAPI32(02B4E5F2,?,?,?,?,000000C8,000000E4), ref: 02B4E520

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 885db2bb3ab5ccd5f02476ea60759e36d67b3d627856264cc673df1026eb848d
Instruction ID: 8b189aaf65ce903ddaf2610ba1043ea2082f1e7100a04166ee0a8d80322e56d8
Opcode Fuzzy Hash: 885db2bb3ab5ccd5f02476ea60759e36d67b3d627856264cc673df1026eb848d
Instruction Fuzzy Hash: 3641F8B2D0021DBFDF119FD4DC84EEEBBBAFB08344F5444A6E910A7150E7319A55AB60

Function 02B4F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02B4F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02B4F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02B4F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02B4F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02B4F2FD

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 6e5ea33e37d125f67e9ba235ce936eb155fa7f81e4b43474c826f419f6b87170
Instruction ID: 747d4856238ed9a8df5a01639476d621a6e5ba189733e7a12673d6061f8c462c
Opcode Fuzzy Hash: 6e5ea33e37d125f67e9ba235ce936eb155fa7f81e4b43474c826f419f6b87170
Instruction Fuzzy Hash: F011FBB1A40248BAEB11DE94CD41F9E7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02B41BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B41AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B41AD4
Part of subcall function 02B41AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B41AE9
Part of subcall function 02B41AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B41B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B41C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02B41C51

Strings

hi_id, xrefs: 02B41BE5
localcfg, xrefs: 02B41BE7

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 78d706fff28ca4e9050d722504db30e4c14b1bedb6caf8219c09533a39ae5b09
Instruction ID: b28d89a3427ce476c16d787d6c8f33f21727c70d1003c9047a910fe858f2da88
Opcode Fuzzy Hash: 78d706fff28ca4e9050d722504db30e4c14b1bedb6caf8219c09533a39ae5b09
Instruction Fuzzy Hash: 6F018472D1412CBBEB50DAECCCC49EFBABCEB48655F1008B5D606E7101D6309E84A661

Function 02B41B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02B41AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B41AD4
Part of subcall function 02B41AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B41AE9
Part of subcall function 02B41AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B41B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B41BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02B41EFD,00000000,00000000,00000000,00000000), ref: 02B41BB8

Strings

localcfg, xrefs: 02B41B7B

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 2a6266f8775f05df465111e681e54d17d9d44bd471f592032f035e261ba71d4f
Instruction ID: 26b458b1e61943883fdf5d28c3fa47ec3f9a628218c8b22477b2c187740b0597
Opcode Fuzzy Hash: 2a6266f8775f05df465111e681e54d17d9d44bd471f592032f035e261ba71d4f
Instruction Fuzzy Hash: F2018FB2D0011CBFE7009BE9C8809EFFABDEF48750F150462E615E7140D9705E044AA0

Function 02B42684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02B42693
gethostbyname.WS2_32(00000001), ref: 02B4269F

Strings

time_cfg, xrefs: 02B42684

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: a47cc4bd74119ba4a8fca0c128d7c276acf525de018cb820d970420ea75e67a9
Instruction ID: 55b1e93c5422b2e15b73651215ce9791d1a044b4af097e360bfcb5a393e5d3e1
Opcode Fuzzy Hash: a47cc4bd74119ba4a8fca0c128d7c276acf525de018cb820d970420ea75e67a9
Instruction Fuzzy Hash: 6BE08C306041218FCB10AA28F484B953BA4EF0A370F014980F880C7190DB309C80A680

Function 02B4E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02B4DD05: GetTickCount.KERNEL32 ref: 02B4DD0F
Part of subcall function 02B4DD05: InterlockedExchange.KERNEL32(02B536B4,00000001), ref: 02B4DD44
Part of subcall function 02B4DD05: GetCurrentThreadId.KERNEL32 ref: 02B4DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,02B4A445), ref: 02B4E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,76230F10,?,00000000,?,02B4A445), ref: 02B4E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,02B4A445), ref: 02B4E5B2

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: ee17d81f92a8120975b42e918c586be825c86a71137fd37282460a6f0f426f1e
Instruction ID: 213654f3f9dcfb3062aeb6f872628f0b3b13dbec2a9a5ac0ef6d6ddb9a5eaef8
Opcode Fuzzy Hash: ee17d81f92a8120975b42e918c586be825c86a71137fd37282460a6f0f426f1e
Instruction Fuzzy Hash: 6E216BB29803143AF2217A255CC6F5B3A4DEF55754F0409D8FE0EB91D3EE51D410AAB1

Function 02B4877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02B488A5

Part of subcall function 02B4F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B4E342,00000000,75B4EA50,80000001,00000000,02B4E513,?,00000000,00000000,?,000000E4), ref: 02B4F089
Part of subcall function 02B4F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B4E342,00000000,75B4EA50,80000001,00000000,02B4E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B4F093

Strings

rresolv, xrefs: 02B487F6, 02B4885C
localcfg, xrefs: 02B487CA, 02B487CF, 02B487FB, 02B48835, 02B48861

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 2c5b792e051e90a905f136c5b038319207fab0b182d1e8c68d599223acd7acb5
Instruction ID: f0606cdd49dd34ee7bc00a384545aef3aa509a82bd2f242ab12f83a180d2a97f
Opcode Fuzzy Hash: 2c5b792e051e90a905f136c5b038319207fab0b182d1e8c68d599223acd7acb5
Instruction Fuzzy Hash: 64210A319893206AF314BB64BDC1F7A3BDAEB44750F540899FD049F1C0EFA1A540A9B2

Function 02B44000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02B522F8,02B442B6,00000000,00000001,02B522F8,00000000,?,02B498FD), ref: 02B44021
GetLastError.KERNEL32(?,02B498FD,00000001,00000100,02B522F8,02B4A3C7), ref: 02B4402C
Sleep.KERNEL32(000001F4,?,02B498FD,00000001,00000100,02B522F8,02B4A3C7), ref: 02B44046

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: ef02fb11798beb61333a9649155f588f640f014e7b1715f3068d918366007be3
Instruction ID: c1aab89b4e748ce9bfe5ad181b0bdec731a8171603988db2a3c99ebdbd64197c
Opcode Fuzzy Hash: ef02fb11798beb61333a9649155f588f640f014e7b1715f3068d918366007be3
Instruction Fuzzy Hash: 71F0A7326402156BD7319A34AC89B1A7271EF85734F294F64F3B5E61D0CB3064B1AB14

Function 02B4DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02B4DC19,?,00000104), ref: 02B4DB7F
lstrcpyA.KERNEL32(?,02B528F8), ref: 02B4DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02B4DBC2

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: ec2cde16627a04c3effbbcfb7232a45c8f76e52c7eff6c594f0020303b84976c
Instruction ID: 130b24ce2dc6564a737f2eb7b5db35220b550a384afefa1316ccf1116022c1a4
Opcode Fuzzy Hash: ec2cde16627a04c3effbbcfb7232a45c8f76e52c7eff6c594f0020303b84976c
Instruction Fuzzy Hash: 4DF09070540349ABEF109F64DC89FD93B69AF14758F104994FB51A90D0D7F2D555CB10

Function 02B4EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B4EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B4EC72
GetTickCount.KERNEL32 ref: 02B4EC78

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 69adf7f3b0cc55dd125731a758fb9fb86a95d8cb2b0228996521de13cdb0ae65
Instruction ID: f276617ed939013058a042d2ea0f09fecfdf5ef88ddb933c310ada9b081d9c04
Opcode Fuzzy Hash: 69adf7f3b0cc55dd125731a758fb9fb86a95d8cb2b0228996521de13cdb0ae65
Instruction Fuzzy Hash: B2E09AF5C50218BFE701ABB0DC4AE6B77FCEF08354F540E54B911DB180DA709A148BA0

Function 02B430B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B430D8
gethostbyname.WS2_32(?), ref: 02B430E2

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: b9a24ac93ed2737de4b53348235ee251928dd26647e16bf03043b97d736dd64c
Instruction ID: 9f4d0b7fc84398ac1108855290cab47c215da775212d53cdefa1aa8ed4d32f56
Opcode Fuzzy Hash: b9a24ac93ed2737de4b53348235ee251928dd26647e16bf03043b97d736dd64c
Instruction Fuzzy Hash: 30E06571D402299BCB00ABA8EC85F9A77ECFB08348F180561F945E7240EA74E5048790

Function 02B4EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B4EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02B4EC0A,00000000,80000001,?,02B4DB55,7FFF0001), ref: 02B4EBAD
Part of subcall function 02B4EBA0: HeapSize.KERNEL32(00000000,?,02B4DB55,7FFF0001), ref: 02B4EBB4

GetProcessHeap.KERNEL32(00000000,02B4EA27,00000000,02B4EA27,00000000), ref: 02B4EC41
RtlFreeHeap.NTDLL(00000000), ref: 02B4EC48

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 788906dc49cb4472560aef74eb20013271afa97f22ed3e9227c37f87c3f31ddf
Instruction ID: aeb93961e6d47e5c0dbf6da1d214d4bdd15742c7c47826c40e10eef3d5901de8
Opcode Fuzzy Hash: 788906dc49cb4472560aef74eb20013271afa97f22ed3e9227c37f87c3f31ddf
Instruction Fuzzy Hash: 51C01232846730ABC5513660B94CF9B6B58EF49B51F090C49F5056B0408B60988056E2

Function 02B4EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B4EBFE,7FFF0001,?,02B4DB55,7FFF0001), ref: 02B4EBD3
RtlAllocateHeap.NTDLL(00000000,?,02B4DB55,7FFF0001), ref: 02B4EBDA

Part of subcall function 02B4EB74: GetProcessHeap.KERNEL32(00000000,00000000,02B4EC28,00000000,?,02B4DB55,7FFF0001), ref: 02B4EB81
Part of subcall function 02B4EB74: HeapSize.KERNEL32(00000000,?,02B4DB55,7FFF0001), ref: 02B4EB88

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 49590ae92b0354f77509aa7b5ad57342f356c21092dd4227e826b9db92a7547d
Instruction ID: a824eebf23652b7b39481e64b9af29c0bd5dc62e13e100342e3fa01cbd7d2331
Opcode Fuzzy Hash: 49590ae92b0354f77509aa7b5ad57342f356c21092dd4227e826b9db92a7547d
Instruction Fuzzy Hash: DCC01232A483306BC60137A4B808B9A2A98AB08BA2F040844FA09CA150CA2088908AA2

Function 02B4F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02B4CA44), ref: 02B4F476

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 33531acb21f41e4abc7ce87cdecfc4c2da0926322d308841a5839796c3d3591f
Instruction ID: 61cd8c1da5ad88205160a42b5e6633736e3ae1516c26878b86cc094e3841aca8
Opcode Fuzzy Hash: 33531acb21f41e4abc7ce87cdecfc4c2da0926322d308841a5839796c3d3591f
Instruction Fuzzy Hash: 86F08C3220015AAB9F019E9ADC84CBB3BAEFB893507480562FA44D7110DE31E8209BA0

Function 02B41978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02B41992

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 842db3302bd7a6c67a19faded2a100bfe9344c3d1bb3449ebb82a76aa95469eb
Instruction ID: d26f32b8dc3e0d1639a6c2031be38c7fdeeade6ae533f37d9da5d09cda645b55
Opcode Fuzzy Hash: 842db3302bd7a6c67a19faded2a100bfe9344c3d1bb3449ebb82a76aa95469eb
Instruction Fuzzy Hash: 9DD022325883312A42003718B80047FAB9CDF082B2701881AFC8CC1100CF30C8829B92

Function 02B4DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B4DDB5

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 09de215a345b6a33779808df282858fb07beef52b9d74cdb7fffe3d90a4e6f55
Instruction ID: 9dacab68d5bab1d460f99a8986ed7a004c53bfdd07f4a792077d32849159bd82
Opcode Fuzzy Hash: 09de215a345b6a33779808df282858fb07beef52b9d74cdb7fffe3d90a4e6f55
Instruction Fuzzy Hash: F3F08C32201313CBCB20CE2498C4756B3E8EF8A729F584DAEE555D3140DF30D855EB11

Non-executed Functions

Function 02B4637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02B49816,EntryPoint), ref: 02B4638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02B49816,EntryPoint), ref: 02B463A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02B463CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02B463EB

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 585daecc3a6deeba87f7cbcbb80959eb48b6f01d551c67dacaf5297403fb805f
Instruction ID: 15bc0a02184be5f79a606bfcb6ed12ea142755c62908db09b7d1bd63defc1cd1
Opcode Fuzzy Hash: 585daecc3a6deeba87f7cbcbb80959eb48b6f01d551c67dacaf5297403fb805f
Instruction Fuzzy Hash: 6011A771A40229BFDB115F69DC49F9B3BACEF057A8F004464F904DB240DB70DC109AA0

Function 02B41000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02B41839,02B49646), ref: 02B41012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02B410C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02B410E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02B41101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02B41121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02B41140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02B41160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02B41180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02B4119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02B411BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02B411DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02B411FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02B4121A

Strings

ntdll.dll, xrefs: 02B4100D
RtlSetLastWin32Error, xrefs: 02B410D6
RtlExpandEnvironmentStrings_U, xrefs: 02B410BC
RtlInitUnicodeString, xrefs: 02B41135
RtlLengthSid, xrefs: 02B41246
NtClose, xrefs: 02B411B4
NtQueryInformationToken, xrefs: 02B41262
NtDuplicateToken, xrefs: 02B411F3
RtlFreeSid, xrefs: 02B41116
RtlNtStatusToDosError, xrefs: 02B41194
NtSetInformationToken, xrefs: 02B41175
RtlAllocateAndInitializeSid, xrefs: 02B4120F
NtFilterToken, xrefs: 02B4122B
NtTerminateProcess, xrefs: 02B410F6
NtSetInformationThread, xrefs: 02B41155
NtOpenProcessToken, xrefs: 02B411D4

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: e023be660172cf7eb432fae1de850566a70d0e4ec28537de979204de1dfa5013
Instruction ID: ca9120e4736453f9263205a1555fbdfd13ed1bd3d92ee426f29d3dd40f61c2d2
Opcode Fuzzy Hash: e023be660172cf7eb432fae1de850566a70d0e4ec28537de979204de1dfa5013
Instruction Fuzzy Hash: 0751A5F1DA272196E7118AACA88079136E5E7483E4F1407D6AE2ADB3E0DB70C4D1DF61

Function 02B4B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B4B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02B4B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B4B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B4B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B4B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02B4B329
wsprintfA.USER32 ref: 02B4B3B7

Strings

Wed, xrefs: 02B4B23A
Sat, xrefs: 02B4B24F
Apr, xrefs: 02B4B26B
Thu, xrefs: 02B4B241
May, xrefs: 02B4B272
Oct, xrefs: 02B4B295
Dec, xrefs: 02B4B2A3
Feb, xrefs: 02B4B25D
Jul, xrefs: 02B4B280
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02B4B3AF
Jan, xrefs: 02B4B256
Mar, xrefs: 02B4B264
Sep, xrefs: 02B4B28E
Mon, xrefs: 02B4B22C
Sun, xrefs: 02B4B225
Fri, xrefs: 02B4B248
Tue, xrefs: 02B4B233
Nov, xrefs: 02B4B29C
Aug, xrefs: 02B4B287
Jun, xrefs: 02B4B279

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 40efee0768d487b2d51be4950bb4746cd2821a7744462a7eff0ccff5665b8b57
Instruction ID: 524c31108007885868fd5469981232677de1b723363c763f29640c057d5992cf
Opcode Fuzzy Hash: 40efee0768d487b2d51be4950bb4746cd2821a7744462a7eff0ccff5665b8b57
Instruction Fuzzy Hash: 3E5130B2D0022CAACF54EFD5D9846EFBBB9FF4D308F1048D9EA01AA150D7745A89DB50

Function 02B46511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B4654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B4655C
htonl.WS2_32(?), ref: 02B46578
htonl.WS2_32(?), ref: 02B46587
wsprintfA.USER32 ref: 02B4659B
wsprintfA.USER32 ref: 02B465DC
wsprintfA.USER32 ref: 02B46671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02B4668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02B46696
wsprintfA.USER32 ref: 02B466B0
wsprintfA.USER32 ref: 02B466E7
wsprintfA.USER32 ref: 02B466FF
wsprintfA.USER32 ref: 02B4671F
ExitProcess.KERNEL32 ref: 02B46755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02B4666B
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02B465D6
%d=%p, xrefs: 02B466F9
except_info, xrefs: 02B46728
12:08:32, xrefs: 02B46535
Jan 13 2018, xrefs: 02B4653A
plgs:, xrefs: 02B466AA
va=%08X%08X uef=%p, xrefs: 02B46595
localcfg, xrefs: 02B4672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 02B46547

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 83341f0d1d561414fa0135c9c52c2260146ebb23e80dfa0efcb40f2916a86239
Instruction ID: 9e41adb396649036e5a59ec0443881862656c87f7ed220cb2e7a5b4cb0c7782b
Opcode Fuzzy Hash: 83341f0d1d561414fa0135c9c52c2260146ebb23e80dfa0efcb40f2916a86239
Instruction Fuzzy Hash: 80617C72940218AFEF60AFA4DC85FEA77E9FF09300F1484A9F969D7121DA7199509F10

Function 02B4A7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B4A7FB
lstrlenA.KERNEL32(?), ref: 02B4A87E
send.WS2_32(?,?,00000000,00000000), ref: 02B4A893
wsprintfA.USER32 ref: 02B4A8AF
send.WS2_32(?,.,00000005,00000000), ref: 02B4A8D2
wsprintfA.USER32 ref: 02B4A8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 02B4A97C
wsprintfA.USER32 ref: 02B4A9B9

Strings

quit, xrefs: 02B4A86C
mail from:<%s>, xrefs: 02B4A848
, xrefs: 02B4A94C
ehlo %s, xrefs: 02B4A7F5
helo %s, xrefs: 02B4A803
data, xrefs: 02B4A85E
localcfg, xrefs: 02B4AB0B
Too big smtp respons (%d bytes), xrefs: 02B4A9B1
ESMTP, xrefs: 02B4AA38
., xrefs: 02B4A8CA
AUTH LOGIN, xrefs: 02B4A80C
rcpt to:<%s>, xrefs: 02B4A855
Incorrect respons, xrefs: 02B4AB39
Error sending command (sent = %d/%d), xrefs: 02B4A8A7, 02B4A8DA
Too small respons, xrefs: 02B4A9C9

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: af47f23c015c3e06778aae8b776bb9385b7db61d85afb4c481e478057a782fcd
Instruction ID: d1efe7c1bc26e47d7d2bd8b8cc09c1b87299d4636f32cb0757a9ec11395b720d
Opcode Fuzzy Hash: af47f23c015c3e06778aae8b776bb9385b7db61d85afb4c481e478057a782fcd
Instruction Fuzzy Hash: D5A13B719C4325ABFF219A54DCE5FAE3B6AFB04308F1408D6F902AB090DF31A954EB51

Function 02B41280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02B4139A
lstrlenW.KERNEL32(-00000003), ref: 02B41571

Strings

@, xrefs: 02B41380
uac, xrefs: 02B41628
<, xrefs: 02B41378
, xrefs: 02B41462
%systemroot%\system32\cmd.exe, xrefs: 02B41316
wusa.exe, xrefs: 02B41388
useless, xrefs: 02B4161E
D, xrefs: 02B415C6

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 806f2951282283199fb9f80930eee2e9f730c3c578a2309a57c7ff3b2654939f
Instruction ID: af7dca4faf994ec2e786d609d424d5333afe644cba6c58f4b1f8e858d40d6cb0
Opcode Fuzzy Hash: 806f2951282283199fb9f80930eee2e9f730c3c578a2309a57c7ff3b2654939f
Instruction Fuzzy Hash: F2F18EB19183519FD720DF68C8C8BAAB7E5FB88344F044D5DFA9A9B240DB74D884CB52

Function 02B42A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 02B42A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 02B42A86
socket.WS2_32(00000002,00000002,00000011), ref: 02B42AA0
htons.WS2_32(00000000), ref: 02B42ADB
select.WS2_32 ref: 02B42B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02B42B4A
htons.WS2_32(?), ref: 02B42B71
htons.WS2_32(?), ref: 02B42B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02B42BFB

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 8f8d9d3d6bec9e1c4c848c2fe5db4b3f4535b2da47be753864d1270589f69490
Instruction ID: db7fcaa7cc1a1bb19ef3086defb13a7ddc4f9173d5e3a6cc8d3f6f8af6c56d82
Opcode Fuzzy Hash: 8f8d9d3d6bec9e1c4c848c2fe5db4b3f4535b2da47be753864d1270589f69490
Instruction Fuzzy Hash: A861F5719043159FD720AF61DC88B6BBBE8FB88785F000C49FD859B141DBB0D980BBA2

Function 02B4704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 02B470C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 02B4719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 02B471B2
RegCloseKey.ADVAPI32(76230F10), ref: 02B47208
RegCloseKey.ADVAPI32(76230F10), ref: 02B47291
___ascii_stricmp.LIBCMT ref: 02B472C2
RegCloseKey.ADVAPI32(76230F10), ref: 02B472D0
RegCloseKey.ADVAPI32(76230F10), ref: 02B47314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B4738D
RegCloseKey.ADVAPI32(76230F10), ref: 02B473D8

Part of subcall function 02B4F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B522F8,000000C8,02B47150,?), ref: 02B4F1AD

Strings

, xrefs: 02B47194
", xrefs: 02B47227

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 8854993e1ca0b446684980cf7ca0d4062c92b20263b85400620b531c6d782a79
Instruction ID: 99c19224503219fd4a88dacd6c1167307c4b2b32619eb3f43d25380f6620b61a
Opcode Fuzzy Hash: 8854993e1ca0b446684980cf7ca0d4062c92b20263b85400620b531c6d782a79
Instruction Fuzzy Hash: 45B18371944219AFDF159FA4DC84FEEB7B9EF04304F1005A6F901E6190EF719A84EB61

Function 02B4AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B4AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B4ADA6

Part of subcall function 02B4AD08: gethostname.WS2_32(?,00000080), ref: 02B4AD1C
Part of subcall function 02B4AD08: lstrlenA.KERNEL32(?), ref: 02B4AD60
Part of subcall function 02B4AD08: lstrlenA.KERNEL32(?), ref: 02B4AD69
Part of subcall function 02B4AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 02B4AD7F

Part of subcall function 02B430B5: gethostname.WS2_32(?,00000080), ref: 02B430D8
Part of subcall function 02B430B5: gethostbyname.WS2_32(?), ref: 02B430E2

wsprintfA.USER32 ref: 02B4AEA5

Part of subcall function 02B4A7A3: inet_ntoa.WS2_32(00000000), ref: 02B4A7A9

wsprintfA.USER32 ref: 02B4AE4F
wsprintfA.USER32 ref: 02B4AE5E

Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B4EF92
Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(?), ref: 02B4EF99
Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(00000000), ref: 02B4EFA0

Strings

%OUTLOOK_MID, xrefs: 02B4AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02B4AE9F
%s%d, xrefs: 02B4AE58
%OUTLOOK_HST, xrefs: 02B4AEC5
%OUTLOOK_BND_, xrefs: 02B4AE0F, 02B4AE14, 02B4AE57, 02B4AE76
127.0.0.1, xrefs: 02B4ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02B4AE49

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 357bb284eb60c2bc7f8b67313c672ca7f9dad824cd31794b8e2c518b4568794b
Instruction ID: 97be765b508c4f6776b2a2ab91217e903893dd2b6057b1c9527430f5a8d446b3
Opcode Fuzzy Hash: 357bb284eb60c2bc7f8b67313c672ca7f9dad824cd31794b8e2c518b4568794b
Instruction Fuzzy Hash: B84111B294021CABEF25EFA0DC85FEF3BADFF08300F144896B91596151EA71D5549F50

Function 02B42DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02B42E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42E4F
htons.WS2_32(00000035), ref: 02B42E88
inet_addr.WS2_32(?), ref: 02B42E93
gethostbyname.WS2_32(?), ref: 02B42EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42EE3
HeapFree.KERNEL32(00000000,?,00000000,02B42F0F,?,02B420FF,02B52000), ref: 02B42EE6

Strings

iphlpapi.dll, xrefs: 02B42DFB, 02B42E00, 02B42E10
GetNetworkParams, xrefs: 02B42E28

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 0b2e5bfcbdd7b306e99cd090c002fef1a9fd5f4c02efc70c98bf207b4f662c56
Instruction ID: dcea9aaa02b3d0267a7a63234df8e2fc03fe14b5d7430842378873ff4cb3b80d
Opcode Fuzzy Hash: 0b2e5bfcbdd7b306e99cd090c002fef1a9fd5f4c02efc70c98bf207b4f662c56
Instruction Fuzzy Hash: 1131C431D8031AABDF11ABB89884BAE7778EF08764F140995FD18EB280DF30D552BB50

Function 02B49326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02B49DD7,?,00000022,?,?,00000000,00000001), ref: 02B49340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02B49DD7,?,00000022,?,?,00000000,00000001), ref: 02B4936E
GetModuleFileNameA.KERNEL32(00000000,?,02B49DD7,?,00000022,?,?,00000000,00000001), ref: 02B49375
wsprintfA.USER32 ref: 02B493CE
wsprintfA.USER32 ref: 02B4940C
wsprintfA.USER32 ref: 02B4948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02B494F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B49526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B49571

Strings

runas, xrefs: 02B49674

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 7cafa597281c6f433c57338a42ac1ef044f679ec9ec1621e8d825c6f207a94bb
Instruction ID: 747978c7897b97dfe06f2144ede38ab958653005b5396eb1312eef78af6b92ff
Opcode Fuzzy Hash: 7cafa597281c6f433c57338a42ac1ef044f679ec9ec1621e8d825c6f207a94bb
Instruction Fuzzy Hash: C0A1AEB2940658AFEB21AFA0CC85FDF3BACEB08344F100496FE0596151DB71D584EFA1

Function 02B4B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B4B467

Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B4EF92
Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(?), ref: 02B4EF99
Part of subcall function 02B4EF7C: lstrlenA.KERNEL32(00000000), ref: 02B4EFA0

Strings

%FROM_DOMAIN, xrefs: 02B4B41E
%FROM_EMAIL, xrefs: 02B4B3E9
%TO_HASH, xrefs: 02B4B4B0
%TO_EMAIL, xrefs: 02B4B473
%M5DATE, xrefs: 02B4B50F
%DATE, xrefs: 02B4B4D2
%TO_DOMAIN, xrefs: 02B4B44B
%P5DATE, xrefs: 02B4B4F2
%FROM_USER, xrefs: 02B4B431
%TO_USER, xrefs: 02B4B488
%s@%s, xrefs: 02B4B461

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: bd0e5111652ece322025582abcd2a6c9d1bb8611daa2a5544ccd3ec5694c298f
Instruction ID: aa487d8ca77c1430bc7d95eb82d22d8f0cb577b5273b87b4c89e5af632f28c51
Opcode Fuzzy Hash: bd0e5111652ece322025582abcd2a6c9d1bb8611daa2a5544ccd3ec5694c298f
Instruction Fuzzy Hash: 18414EB29401297EEF01AAA4CCC1DBF7B6DFF49748F140595FE05B6011EE31EA14ABA1

Function 02B42011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B42078
GetTickCount.KERNEL32 ref: 02B420D4
GetTickCount.KERNEL32 ref: 02B420DB
GetTickCount.KERNEL32 ref: 02B4212B
GetTickCount.KERNEL32 ref: 02B42132
GetTickCount.KERNEL32 ref: 02B42142

Part of subcall function 02B4F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B4E342,00000000,75B4EA50,80000001,00000000,02B4E513,?,00000000,00000000,?,000000E4), ref: 02B4F089
Part of subcall function 02B4F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B4E342,00000000,75B4EA50,80000001,00000000,02B4E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B4F093

Part of subcall function 02B4E854: lstrcpyA.KERNEL32(00000001,?,?,02B4D8DF,00000001,localcfg,except_info,00100000,02B50264), ref: 02B4E88B
Part of subcall function 02B4E854: lstrlenA.KERNEL32(00000001,?,02B4D8DF,00000001,localcfg,except_info,00100000,02B50264), ref: 02B4E899

Part of subcall function 02B41C5F: wsprintfA.USER32 ref: 02B41CE1

Strings

net_type, xrefs: 02B421DF
rbl_bl, xrefs: 02B42181
localcfg, xrefs: 02B42070, 02B42160, 02B42186, 02B42194, 02B421E4
rbl_ip, xrefs: 02B4218F

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 1842695174d7ebe36a1f39c32ecbc88dd4ed411322b77c74409b636ccd6f2c48
Instruction ID: 411bf1b245b6958fbbc3c899c3601cd8007cd323803027172861fab84d1eb216
Opcode Fuzzy Hash: 1842695174d7ebe36a1f39c32ecbc88dd4ed411322b77c74409b636ccd6f2c48
Instruction Fuzzy Hash: 9D512175D863565EE728EF24EDC5B263BD5EB04344F00089AFE858B290DFB1A094FA21

Function 02B4C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B4A4C7: GetTickCount.KERNEL32 ref: 02B4A4D1
Part of subcall function 02B4A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02B4A4FA

GetTickCount.KERNEL32 ref: 02B4C31F
GetTickCount.KERNEL32 ref: 02B4C32B
GetTickCount.KERNEL32 ref: 02B4C363
GetTickCount.KERNEL32 ref: 02B4C378
GetTickCount.KERNEL32 ref: 02B4C44D
InterlockedIncrement.KERNEL32(02B4C4E4), ref: 02B4C4AE
CreateThread.KERNEL32(00000000,00000000,02B4B535,00000000,?,02B4C4E0), ref: 02B4C4C1
CloseHandle.KERNEL32(00000000,?,02B4C4E0,02B53588,02B48810), ref: 02B4C4CC

Strings

localcfg, xrefs: 02B4C2DD

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: aca5cf02933fc4d2e27592ead18ad67ccf0f303c206983824516ce1734938067
Instruction ID: 01375f74819ca5a6dc72cc875da2c9d5abfc246f0d839525751aeb3ae17ae7fa
Opcode Fuzzy Hash: aca5cf02933fc4d2e27592ead18ad67ccf0f303c206983824516ce1734938067
Instruction Fuzzy Hash: B6518FB1A01B418FD7249F69C6C462ABBE9FB48704B549D3EE18BC7A90DB74F840DB14

Function 02B4BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B4BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B4BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B4BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B4BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B4BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B4BF94

Strings

smtp_herr, xrefs: 02B4BE46, 02B4BF62
smtp_retr, xrefs: 02B4BE61, 02B4BF8C
smtp_ban, xrefs: 02B4BE55, 02B4BF77

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 9cecfe119d3e3098e80e98a0bd4f9f218fc68ea1cb3c6d82a841cad810110867
Instruction ID: 9f2c8d8e0da20ee96557009a95fd3954e730ba1a16a775a6cd5eaea8f302f0ea
Opcode Fuzzy Hash: 9cecfe119d3e3098e80e98a0bd4f9f218fc68ea1cb3c6d82a841cad810110867
Instruction Fuzzy Hash: BE519071E0061AAFDF119E68C8C0B6EBBA9EF44348F0445D9EE459B251DB30E951EF90

Function 02B46A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46A7D
GetDiskFreeSpaceA.KERNEL32(02B49E9D,02B49A60,?,?,?,02B522F8,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02B49A60,?,?,02B49E9D), ref: 02B46B80
GetLastError.KERNEL32(?,?,?,02B49A60,?,?,02B49E9D,?,?,?,?,?,02B49E9D,?,00000022,?), ref: 02B46B96

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 912745b763395b2c21a081b17ba6d526cbae76192484eecb33686c103bdb4f96
Instruction ID: 74f1abe30b8bb072e69a46c5f39dcd1a66a9a513b6c985f9c4c4a2e20e6fb0b5
Opcode Fuzzy Hash: 912745b763395b2c21a081b17ba6d526cbae76192484eecb33686c103bdb4f96
Instruction Fuzzy Hash: 8431E4B2D0024DAFDB01AFA08885BDFBB7DFF49380F0448A6E651A7100DB3095549F61

Function 02B46F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02B4D7C3), ref: 02B46F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02B4D7C3), ref: 02B46FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02B46FE8
LocalFree.KERNEL32(00000120), ref: 02B4701F
wsprintfA.USER32 ref: 02B47036

Strings

|, xrefs: 02B46FB3
/%d, xrefs: 02B47030

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: f12909375bb19e14f46041b419b3095ec22527ff515575d63d1baf5247e15c47
Instruction ID: a28345189954a3ffaf8a95b40798a7bd90cb38c1e2a1fa97884bd02f28048f21
Opcode Fuzzy Hash: f12909375bb19e14f46041b419b3095ec22527ff515575d63d1baf5247e15c47
Instruction Fuzzy Hash: CA31FD72900219AFDB01DFA4D884BDE7BBCEF09354F148596F859DB200DB75E604DB94

Function 02B46CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02B522F8,000000E4,02B46DDC,000000C8), ref: 02B46CE7
GetProcAddress.KERNEL32(00000000), ref: 02B46CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02B46D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02B46D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02B46CDD
C:\Windows\SysWOW64\, xrefs: 02B46CC9, 02B46CD1, 02B46CFE, 02B46D05, 02B46D13, 02B46D1E, 02B46D2A, 02B46D42, 02B46D5F, 02B46D85
kernel32, xrefs: 02B46CE2

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 490600c2701974c79377fc14b1d6c6c00cd135fde97e92d399670decbcf4110e
Instruction ID: 4fcb9a60f797be2b8b522a65484917964a834c3355a3a75510ad63597b5892f6
Opcode Fuzzy Hash: 490600c2701974c79377fc14b1d6c6c00cd135fde97e92d399670decbcf4110e
Instruction Fuzzy Hash: 7221D151A8236479F72666225CC8FB72F9DCB4B788F0908C4FC44AF081CF958486A6A6

Function 02B4977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02B49947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02B522F8), ref: 02B497B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02B522F8), ref: 02B497EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02B522F8), ref: 02B497F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02B522F8), ref: 02B49831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02B522F8), ref: 02B4984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02B522F8), ref: 02B4985B

Strings

D, xrefs: 02B497A9

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 442a44f0d029b2cfbfb7e9f949c17474b836eff8c4975547984bd392552525fa
Instruction ID: 09369ce07a804820010fda5e784127632d3d2b3de67949be086ed1bebbc3472a
Opcode Fuzzy Hash: 442a44f0d029b2cfbfb7e9f949c17474b836eff8c4975547984bd392552525fa
Instruction Fuzzy Hash: 22212E71D41229ABDB11AFA1DC89FEF7B7CEF09794F0008A1F919E6040EB309654DBA1

Function 02B4E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B4DD05: GetTickCount.KERNEL32 ref: 02B4DD0F
Part of subcall function 02B4DD05: InterlockedExchange.KERNEL32(02B536B4,00000001), ref: 02B4DD44
Part of subcall function 02B4DD05: GetCurrentThreadId.KERNEL32 ref: 02B4DD53

Part of subcall function 02B4DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B4DDB5

lstrcpynA.KERNEL32(?,02B41E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02B4EAAA,?,?), ref: 02B4E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02B4EAAA,?,?,00000001,?,02B41E84,?), ref: 02B4E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02B4EAAA,?,?,00000001,?,02B41E84,?,0000000A), ref: 02B4E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02B4EAAA,?,?,00000001,?,02B41E84,?), ref: 02B4E94F

Strings

flags_upd, xrefs: 02B4E8A7
localcfg, xrefs: 02B4E8AB

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: beda793e9fbd31f6a98685cc37de7e17ccc4cef37afb543c36e231417842550b
Instruction ID: a38bcfc21399240146341c82939848c3a2903e1bad729cb4b438d4804608cfa5
Opcode Fuzzy Hash: beda793e9fbd31f6a98685cc37de7e17ccc4cef37afb543c36e231417842550b
Instruction Fuzzy Hash: 1D511E72D0020AAFCB11EFA8C9C49AEB7F9FF48304F1445AAE515A7210EB35EA159F50

Function 02B46BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02B46BB2

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 90d32068bbb8ecb33db729e850f95094e8f91993a747c27a33b077cff704403c
Instruction ID: 0f20ad26ce10bcdaffd746e791256116baf57f04d46dfaa0f08bab47bd9f4eb6
Opcode Fuzzy Hash: 90d32068bbb8ecb33db729e850f95094e8f91993a747c27a33b077cff704403c
Instruction Fuzzy Hash: B8218172904225FFDB116BA4EDC9E9F7BACEF093A4B144895F502E6041EF31DA10E674

Function 02B49064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02B522F8), ref: 02B4907B
wsprintfA.USER32 ref: 02B490E9
CreateFileA.KERNEL32(02B522F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B4910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B49122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B4912D
CloseHandle.KERNEL32(00000000), ref: 02B49134

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 8035b21a36ab1da9852e3b3a66a062ee6a6a297ee5eff223033b126091915d2a
Instruction ID: 050241a28e2214c2de436a0363c1c6e97f9b00efbd741a753e0ab42b47d1550f
Opcode Fuzzy Hash: 8035b21a36ab1da9852e3b3a66a062ee6a6a297ee5eff223033b126091915d2a
Instruction Fuzzy Hash: 8D119AB6A405247BF7257631DC49FAF366EDFC8700F0488A5BF0AE6051EE708A519A60

Function 02B4DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B4DD0F
GetCurrentThreadId.KERNEL32 ref: 02B4DD20
GetTickCount.KERNEL32 ref: 02B4DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,02B4E538,?,76230F10,?,00000000,?,02B4A445), ref: 02B4DD3B
InterlockedExchange.KERNEL32(02B536B4,00000001), ref: 02B4DD44
GetCurrentThreadId.KERNEL32 ref: 02B4DD53

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 3561cd37a5711731624363c6e5dfae86a548d1208bfb67fa71cbd3a2c434d11d
Instruction ID: f43001c01098785160b89864912feb834b443d3dc0376d16534b4662541ee255
Opcode Fuzzy Hash: 3561cd37a5711731624363c6e5dfae86a548d1208bfb67fa71cbd3a2c434d11d
Instruction Fuzzy Hash: 75F0E272988339AFC7806BA5A8D4B293BE5EB493D2F040C99E709CB340CB245065DF22

Function 02B4AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B4AD1C
lstrlenA.KERNEL32(?), ref: 02B4AD60
lstrlenA.KERNEL32(?), ref: 02B4AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 02B4AD7F

Strings

LocalHost, xrefs: 02B4AD79

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 49fdd741be856b0a219f05001fb3df5c03faf7a360fa33abac85231c70ac789e
Instruction ID: 8f2d8137f53a315bde74dac60dfab9b753e71f75b413a6da9526a9fa54a63b68
Opcode Fuzzy Hash: 49fdd741be856b0a219f05001fb3df5c03faf7a360fa33abac85231c70ac789e
Instruction Fuzzy Hash: 550145248C42A95EDF351A3888E4BF43F6AEF8A74AF0404D5E4C08B111EF24A083A762

Function 02B44280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02B498FD,00000001,00000100,02B522F8,02B4A3C7), ref: 02B44290
CloseHandle.KERNEL32(02B4A3C7), ref: 02B443AB
CloseHandle.KERNEL32(00000001), ref: 02B443AE

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: e12a1811cd1b27f8aaffa3e634fd8bae7b640f50a22df2b45907d17962dc9fd2
Instruction ID: 6040bde362c82e8a496e1d07c836ff7ab87a76c38f9f98f986ede0127c57a933
Opcode Fuzzy Hash: e12a1811cd1b27f8aaffa3e634fd8bae7b640f50a22df2b45907d17962dc9fd2
Instruction Fuzzy Hash: A8419F71D00209BBDF10ABA1DDC5FAFBFB9EF44364F2045A5F615A6180DB349A50EBA0

Function 02B46069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02B464CF,00000000), ref: 02B4609C
LoadLibraryA.KERNEL32(?,?,02B464CF,00000000), ref: 02B460C3
GetProcAddress.KERNEL32(?,00000014), ref: 02B4614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02B4619E

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: f2c4f439a87714c75a8ddc1b7649684dd68b03edf35c655e33240f51cb1639be
Instruction ID: db52e029b08be0861f4c367fc85a66eab555ba18f839411e0b0478f0611aff3a
Opcode Fuzzy Hash: f2c4f439a87714c75a8ddc1b7649684dd68b03edf35c655e33240f51cb1639be
Instruction Fuzzy Hash: 4C416D71E00206AFDB14CF58C8C4B69B7B9FF05758F1484A9E815D7391DB30E984EB90

Function 02B42923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a85cd7ea409518bd8430b727a058b2724ed2a93a51f7e53e2858ed42b3b2d4c
Instruction ID: 288e28e854358262a203d12fb4cdd568239a4005d9a351d0e47b064d5dc243fb
Opcode Fuzzy Hash: 8a85cd7ea409518bd8430b727a058b2724ed2a93a51f7e53e2858ed42b3b2d4c
Instruction Fuzzy Hash: E7317C71A00219ABDB109FA5CCC1BBEB7F4EF48741F104896FD54EA241EA74D681AB50

Function 02B426FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B4272E
htons.WS2_32(00000001), ref: 02B42752
htons.WS2_32(0000000F), ref: 02B427D5
htons.WS2_32(00000001), ref: 02B427E3
sendto.WS2_32(?,02B52BF8,00000009,00000000,00000010,00000010), ref: 02B42802

Part of subcall function 02B4EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B4EBFE,7FFF0001,?,02B4DB55,7FFF0001), ref: 02B4EBD3
Part of subcall function 02B4EBCC: RtlAllocateHeap.NTDLL(00000000,?,02B4DB55,7FFF0001), ref: 02B4EBDA

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 889712beb4732b31b5f6ca0f6580827ecdbf0994783e12f8fae0475da379346a
Instruction ID: 64e1c1b0c3ec07a368f035509dc802671d715a2782fd83649af0da43099624b8
Opcode Fuzzy Hash: 889712beb4732b31b5f6ca0f6580827ecdbf0994783e12f8fae0475da379346a
Instruction Fuzzy Hash: 04314534A823D69FD7109F74D8C0F657B60EF19358B1988ADEC558F312DA32D892EB10

Function 02B49145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02B522F8), ref: 02B4915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02B49166
CharToOemA.USER32(?,?), ref: 02B49174
wsprintfA.USER32 ref: 02B491A9

Part of subcall function 02B49064: GetTempPathA.KERNEL32(00000400,?,00000000,02B522F8), ref: 02B4907B
Part of subcall function 02B49064: wsprintfA.USER32 ref: 02B490E9
Part of subcall function 02B49064: CreateFileA.KERNEL32(02B522F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B4910E
Part of subcall function 02B49064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B49122
Part of subcall function 02B49064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B4912D
Part of subcall function 02B49064: CloseHandle.KERNEL32(00000000), ref: 02B49134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02B491E1

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 8a7e28b238da3a24c43ac35fa8ca142c06333b36337925af1f2c7cb461794226
Instruction ID: 2f4bbdadef5740220d9658695b8f6344f393ba81dc0c601282c20251ebd09483
Opcode Fuzzy Hash: 8a7e28b238da3a24c43ac35fa8ca142c06333b36337925af1f2c7cb461794226
Instruction Fuzzy Hash: E2015EF69402687BEB20A6619D89FDF7B7CDB99B01F000891BB49E6040EA7096C59F71

Function 02B42419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02B42491,?,?,?,02B4E844,-00000030,?,?,?,00000001), ref: 02B42429
lstrlenA.KERNEL32(?,?,02B42491,?,?,?,02B4E844,-00000030,?,?,?,00000001,02B41E3D,00000001,localcfg,lid_file_upd), ref: 02B4243E
lstrcmpiA.KERNEL32(?,?), ref: 02B42452
lstrlenA.KERNEL32(?,?,02B42491,?,?,?,02B4E844,-00000030,?,?,?,00000001,02B41E3D,00000001,localcfg,lid_file_upd), ref: 02B42467

Strings

localcfg, xrefs: 02B4241F

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 4c82ffd767fc98d8699a7f380a67062862ebef1999e675b7044204250b82eff7
Instruction ID: c5f61a99f37c18bb0d7a6823282b0895fa4ee88637130975dfcd70dde4b290f1
Opcode Fuzzy Hash: 4c82ffd767fc98d8699a7f380a67062862ebef1999e675b7044204250b82eff7
Instruction Fuzzy Hash: F601DA31A00218AFCF11EF69DC849DE7BA9EF44394B49C465FD59D7201E730EA50EB90

Function 02B41C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B41CE1
wsprintfA.USER32 ref: 02B41D6B

Strings

%u.%u.%u.%u.%s, xrefs: 02B41CDB, 02B41D65
localcfg, xrefs: 02B41C70

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 9fd2d690591a1ccc13ccbe15261fa7ebe58f858cdc1946ff2cb38a14deb3d952
Instruction ID: 52bb7bcb1d40df579ba6c0ea603f71f939afc4b4bafbec987c7e308a96ce0a62
Opcode Fuzzy Hash: 9fd2d690591a1ccc13ccbe15261fa7ebe58f858cdc1946ff2cb38a14deb3d952
Instruction Fuzzy Hash: 47418C729042989FDF21DEB98984BEE3BE9AF49310F240095FD64D7151DA34D604DBA0

Function 02B4E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B4DD05: GetTickCount.KERNEL32 ref: 02B4DD0F
Part of subcall function 02B4DD05: InterlockedExchange.KERNEL32(02B536B4,00000001), ref: 02B4DD44
Part of subcall function 02B4DD05: GetCurrentThreadId.KERNEL32 ref: 02B4DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,02B45EC1), ref: 02B4E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,02B45EC1), ref: 02B4E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,76230F10,00000000,?,02B45EC1), ref: 02B4E722

Strings

89ABCDEF, xrefs: 02B4E721

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 2747b97098d5dd786e25176dfd650ad65d99d1dba98bdf8f0f391a3bcbccd455
Instruction ID: 8da42ad84403d3249009190f3f175b7351234a99329be02a7d608fab3519bf86
Opcode Fuzzy Hash: 2747b97098d5dd786e25176dfd650ad65d99d1dba98bdf8f0f391a3bcbccd455
Instruction Fuzzy Hash: C831ED32A01326DFCB318F64D8C4B6B77E5FF05364F1448AAE9458B542EB70E880EB81

Function 02B4E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02B4E2A3,00000000,00000000,00000000,00020106,00000000,02B4E2A3,00000000,000000E4), ref: 02B4E0B2
RegSetValueExA.ADVAPI32(02B4E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02B522F8), ref: 02B4E127
RegDeleteValueA.ADVAPI32(02B4E2A3,?,?,?,?,?,000000C8,02B522F8), ref: 02B4E158
RegCloseKey.ADVAPI32(02B4E2A3,?,?,?,?,000000C8,02B522F8,?,?,?,?,?,?,?,?,02B4E2A3), ref: 02B4E161

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 38a000596df9354b40954b9587cff90b5f80625388f852a1d12cd6c6d820b1ad
Instruction ID: f775a997cf5a40c5eb4519d81906c5ac035898b463ac44b33868cdc240ef302e
Opcode Fuzzy Hash: 38a000596df9354b40954b9587cff90b5f80625388f852a1d12cd6c6d820b1ad
Instruction Fuzzy Hash: 50217C71A40229BBDF209EA4DC89E9E7FB9EF08790F0440A1F904A6150EA71DA54DB90

Function 02B43F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02B4A3C7,00000000,00000000,000007D0,00000001), ref: 02B43FB8
GetLastError.KERNEL32 ref: 02B43FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B43FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B43FE6

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: e753420873e189b6dd1a227f5123fb4fa5cf3e16096e86bb6c520afef10c1904
Instruction ID: a2793c2cf931b6df8238ea4b2231388fab229e334b5e61f4ef94aa881b5b08d9
Opcode Fuzzy Hash: e753420873e189b6dd1a227f5123fb4fa5cf3e16096e86bb6c520afef10c1904
Instruction Fuzzy Hash: 5501177291021AABDF01DF90D985BEF7BBCFB08355F144492F902E6040DB319A249BA1

Function 02B43F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02B4A3C7,00000000,00000000,000007D0,00000001), ref: 02B43F44
GetLastError.KERNEL32 ref: 02B43F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B43F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B43F72

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: e2de9a7bcd8c778690b1a5f4d155a128b5090a20eebf004ede993a0e940ba6ca
Instruction ID: 5c131d251dd6cc5f0c51ff4115215e6c1b0148f44899d1ff803d9222a0c06d1c
Opcode Fuzzy Hash: e2de9a7bcd8c778690b1a5f4d155a128b5090a20eebf004ede993a0e940ba6ca
Instruction Fuzzy Hash: 2D01D772911219ABDF01DF90D984BEF7BBCFB08395F1449A6FA01E6040D7309A249BA1

Function 02B44E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B44E9E
GetTickCount.KERNEL32 ref: 02B44EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02B44EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02B44EC3

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: af78be4d9eba96efb44c5046e52b91819bcf503542311407bebb9faa4f7f8f03
Instruction ID: 6e18c086af9354276a25932313fa54328f0800c649d43afabaa2effaaf6b9175
Opcode Fuzzy Hash: af78be4d9eba96efb44c5046e52b91819bcf503542311407bebb9faa4f7f8f03
Instruction Fuzzy Hash: C6E0863268132857D61036B9ACC4F6B76599F493B1F090D71FB09D7140CA96D46255B1

Function 02B4A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B4A4D1
GetTickCount.KERNEL32 ref: 02B4A4E4
Sleep.KERNEL32(00000000,?,02B4C2E9,02B4C4E0,00000000,localcfg,?,02B4C4E0,02B53588,02B48810), ref: 02B4A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02B4A4FA

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: c8e878d884c13b00a129214b855d4529e039389783588a015c599f863a640e25
Instruction ID: 7db104f7a338402be98d282c684a3af67778062adf7219fa2314bab20c21cb64
Opcode Fuzzy Hash: c8e878d884c13b00a129214b855d4529e039389783588a015c599f863a640e25
Instruction Fuzzy Hash: B0E0263328032867C60037A5ACC4F6F3388EF4D7A1F0D08A1FF04E7140CA16A55196B2

Function 02B44BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B44BDD
GetTickCount.KERNEL32 ref: 02B44BEC
Sleep.KERNEL32(00000000,?,?,?,0301E06C,02B450F2), ref: 02B44BF9
InterlockedExchange.KERNEL32(0301E060,00000001), ref: 02B44C02

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 798824589ed1dd997141d36adb8e8eaf3000ab901349396e7910f26fbd1e94c0
Instruction ID: d40d8cebac429f74bd66904ad76a31be29d9a19aa2364c377b15e874048a1a29
Opcode Fuzzy Hash: 798824589ed1dd997141d36adb8e8eaf3000ab901349396e7910f26fbd1e94c0
Instruction Fuzzy Hash: 41E0863668132867C61036A55DC0F5A7768DF493A2F0A0CA2FB08D7140C956946156B1

Function 02B430FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B43103
GetTickCount.KERNEL32 ref: 02B4310F
Sleep.KERNEL32(00000000), ref: 02B4311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02B43128

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: fdfc5fc4c9fcb461e322ef4a64c94bd96afb4dcb2b5027e908062bdfe676e594
Instruction ID: f6746dd6d00c7803adbf9ec34868c8c20eda78faeac7480cbb06accab9369570
Opcode Fuzzy Hash: fdfc5fc4c9fcb461e322ef4a64c94bd96afb4dcb2b5027e908062bdfe676e594
Instruction Fuzzy Hash: 52E0C231640329ABDB003B75ADC5B4A6B9ADF887A1F190CB1F601EB090CA5048509A72

Function 02B48CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B48D02
GetTickCount.KERNEL32 ref: 02B48DA1

Strings

localcfg, xrefs: 02B48D19

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 0c630e7fdfebab25a5b180e67bc551f08367327a4ad3d649db9ee3b798ceebd0
Instruction ID: c5bf01e3b42add10cdd1c8c80b859e0184a0d3a3f07f00a527dcca96809081b5
Opcode Fuzzy Hash: 0c630e7fdfebab25a5b180e67bc551f08367327a4ad3d649db9ee3b798ceebd0
Instruction Fuzzy Hash: 9321A232A12625AFDB149FA8DCD565ABBBAEF20394B2944DDD401DB211CF30E940DB50

Function 02B4BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B4BFD0
wsprintfA.USER32 ref: 02B4C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02B4C057

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 638944d02c55df65210069afe3c5923d1ccab63db52ac436076c513fc026ccaf
Instruction ID: df7da744b6d59034e238d9e4c05f3167d66c4292079e3991d3a1e9adc5be6940
Opcode Fuzzy Hash: 638944d02c55df65210069afe3c5923d1ccab63db52ac436076c513fc026ccaf
Instruction Fuzzy Hash: A4119772500110FFDB429AA9CD44E567FA6FF8C358B34859CF6188E166D633D863EB50

Function 02B426B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02B426C3
inet_ntoa.WS2_32(?), ref: 02B426E4

Strings

localcfg, xrefs: 02B426CD, 02B426D2, 02B426DE

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d1bae42f87d5a87513af5ef79106be8b848bf92bc772d0a4fc5bef6f2f518ca1
Instruction ID: cda26d53dffdc197d4b2ee39e94f884558e9dc7e4883a9208718e66ea1231271
Opcode Fuzzy Hash: d1bae42f87d5a87513af5ef79106be8b848bf92bc772d0a4fc5bef6f2f518ca1
Instruction Fuzzy Hash: BCF012325482197BEB006EA4EC45BAA379DEB09754F144865FD08DA090DF71E950AB98

Function 02B49961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(hvjnshqw,Function_00009867), ref: 02B4996C

Part of subcall function 02B49892: SetServiceStatus.ADVAPI32(02B53394), ref: 02B498EB

Part of subcall function 02B498F2: Sleep.KERNEL32(000003E8,00000100,02B522F8,02B4A3C7), ref: 02B49909

Strings

Xd|, xrefs: 02B49974, 02B499BA
hvjnshqw, xrefs: 02B49967, 02B499AD

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Service$CtrlHandlerRegisterSleepStatus
String ID: Xd|$hvjnshqw
API String ID: 1317371667-1444363091
Opcode ID: 7d665667e81d105b6a98f888c771736448280abe1dde77ed6c710880e6955c1d
Instruction ID: b797a0547523c0065d76504c2eaab6f4c720ac48281406b33a1d31fc9b187658
Opcode Fuzzy Hash: 7d665667e81d105b6a98f888c771736448280abe1dde77ed6c710880e6955c1d
Instruction Fuzzy Hash: 45F089B1DC0714AEF2106F545CD6B13339DE7503C8F0484E5B7054E240EFB54824AA21

Function 02B4EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02B4EB54,_alldiv,02B4F0B7,80000001,00000000,00989680,00000000,?,?,?,02B4E342,00000000,75B4EA50,80000001,00000000), ref: 02B4EAF2
GetProcAddress.KERNEL32(77310000,00000000), ref: 02B4EB07

Strings

ntdll.dll, xrefs: 02B4EAED

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: df5da11de002888fa75da9911fc18e8d363c111df8860d874ecb520065d0b657
Instruction ID: 87a71438f9eacc362f082e4b69fa74b233640eb059f0105bb981d2d86c75f067
Opcode Fuzzy Hash: df5da11de002888fa75da9911fc18e8d363c111df8860d874ecb520065d0b657
Instruction Fuzzy Hash: A7D0C934A843629B9F125F68998AF4576E8FB587C1B404C99F40ADB200EB31E464EA01

Function 02B42F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02B42D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,02B42F01,?,02B420FF,02B52000), ref: 02B42D3A
Part of subcall function 02B42D21: LoadLibraryA.KERNEL32(?), ref: 02B42D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B42F73
HeapFree.KERNEL32(00000000), ref: 02B42F7A

Memory Dump Source

Source File: 00000010.00000002.3360799224.0000000002B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b40000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 8be4bce2352fbd1d09260200748c2948bc8f7d12f3452b3ad49cf6ff4dbe4b18
Instruction ID: b9efdeac0d15595eb9a643245289206f3ef2ebca3024bae523d6dd4713d64706
Opcode Fuzzy Hash: 8be4bce2352fbd1d09260200748c2948bc8f7d12f3452b3ad49cf6ff4dbe4b18
Instruction Fuzzy Hash: C95191719002169FDF01DF64D888AF9B7B5FF09304F2446A9EC96D7210EB32EA19DB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rpzOeQ5QzX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\xnjytljr.exe

C:\Windows\SysWOW64\hvjnshqw\xnjytljr.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
rpzOeQ5QzX.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre