Edit tour

Windows Analysis Report
dIg0MWRViP.exe

Overview

General Information

Sample name:	dIg0MWRViP.exe renamed because original name is a hash value
Original sample name:	a6c7dd82eace106350d20d93956360e6.exe
Analysis ID:	1444764
MD5:	a6c7dd82eace106350d20d93956360e6
SHA1:	19c5ea0607b527e4c2b08a39583db38f503933e0
SHA256:	b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f
Tags:	32exetrojan
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

dIg0MWRViP.exe (PID: 5436 cmdline: "C:\Users\user\Desktop\dIg0MWRViP.exe" MD5: A6C7DD82EACE106350D20D93956360E6)

cmd.exe (PID: 5100 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\soirllif\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2828 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rdliobhf.exe" C:\Windows\SysWOW64\soirllif\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7204 cmdline: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7252 cmdline: "C:\Windows\System32\sc.exe" description soirllif "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7320 cmdline: "C:\Windows\System32\sc.exe" start soirllif MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7456 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7552 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1032 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rdliobhf.exe (PID: 7372 cmdline: C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d"C:\Users\user\Desktop\dIg0MWRViP.exe" MD5: 0E6E38A8AE20C869A188C52EA93ADF1C)

svchost.exe (PID: 7392 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 544 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7408 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7444 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7500 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1498:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1598:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: dIg0MWRViP.exe PID: 5436	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: rdliobhf.exe PID: 7372	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 7392	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.3.rdliobhf.exe.24e0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.rdliobhf.exe.24e0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.dIg0MWRViP.exe.3fa0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.dIg0MWRViP.exe.3fa0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.rdliobhf.exe.24c0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.24c0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.dIg0MWRViP.exe.24f0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.dIg0MWRViP.exe.24f0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.rdliobhf.exe.24c0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.rdliobhf.exe.24c0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.24c0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.rdliobhf.exe.24e0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.rdliobhf.exe.24e0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.rdliobhf.exe.24e0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.rdliobhf.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.svchost.exe.2f10000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.svchost.exe.2f10000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.svchost.exe.2f10000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.dIg0MWRViP.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.dIg0MWRViP.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.dIg0MWRViP.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.dIg0MWRViP.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.dIg0MWRViP.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.dIg0MWRViP.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.rdliobhf.exe.24e0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.rdliobhf.exe.24e0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.24e0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.rdliobhf.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.rdliobhf.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.rdliobhf.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.svchost.exe.2f10000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.svchost.exe.2f10000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.svchost.exe.2f10000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.rdliobhf.exe.24e0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.rdliobhf.exe.24e0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.rdliobhf.exe.24e0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d"C:\Users\user\Desktop\dIg0MWRViP.exe", ParentImage: C:\Windows\SysWOW64\soirllif\rdliobhf.exe, ParentProcessId: 7372, ParentProcessName: rdliobhf.exe, ProcessCommandLine: svchost.exe, ProcessId: 7392, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\dIg0MWRViP.exe", ParentImage: C:\Users\user\Desktop\dIg0MWRViP.exe, ParentProcessId: 5436, ParentProcessName: dIg0MWRViP.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7204, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.47.53.36, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 7392, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d"C:\Users\user\Desktop\dIg0MWRViP.exe", ParentImage: C:\Windows\SysWOW64\soirllif\rdliobhf.exe, ParentProcessId: 7372, ParentProcessName: rdliobhf.exe, ProcessCommandLine: svchost.exe, ProcessId: 7392, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 7392, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\soirllif

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\dIg0MWRViP.exe", ParentImage: C:\Users\user\Desktop\dIg0MWRViP.exe, ParentProcessId: 5436, ParentProcessName: dIg0MWRViP.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7204, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7408, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443	URL Reputation: Label: malware
Source: jotunheim.name:443	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\rdliobhf.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Found malware configuration

Source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for submitted file

Source: dIg0MWRViP.exe	ReversingLabs: Detection: 34%
Source: dIg0MWRViP.exe	Virustotal: Detection: 41%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\rdliobhf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: dIg0MWRViP.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Unpacked PE file: 0.2.dIg0MWRViP.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Unpacked PE file: 11.2.rdliobhf.exe.400000.0.unpack

Source: dIg0MWRViP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\soirllif

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.8.199.94 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 67.195.228.94 67.195.228.94
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 104.47.53.36 104.47.53.36

Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: SPRINTHOSTRU SPRINTHOSTRU
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 104.47.53.36:25
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 142.251.168.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dIg0MWRViP.exe PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rdliobhf.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7392, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.3.rdliobhf.exe.24e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.rdliobhf.exe.24e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.24c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.24c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\soirllif\

Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_02F1C913	12_2_02F1C913

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: String function: 024F27AB appears 35 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372

Source: dIg0MWRViP.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.3.rdliobhf.exe.24e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.rdliobhf.exe.24e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.24c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.24c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@30/3@9/5

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_0237E5C6 CreateToolhelp32Snapshot,Module32First,

0_2_0237E5C6

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_02F19A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_02F19A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7500:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7444:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

File created: C:\Users\user\AppData\Local\Temp\rdliobhf.exe

Jump to behavior

Source: dIg0MWRViP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dIg0MWRViP.exe	ReversingLabs: Detection: 34%
Source: dIg0MWRViP.exe	Virustotal: Detection: 41%

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

File read: C:\Users\user\Desktop\dIg0MWRViP.exe

Jump to behavior

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_11-14862

Source: unknown	Process created: C:\Users\user\Desktop\dIg0MWRViP.exe "C:\Users\user\Desktop\dIg0MWRViP.exe"
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\soirllif\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rdliobhf.exe" C:\Windows\SysWOW64\soirllif\
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description soirllif "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start soirllif
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\soirllif\rdliobhf.exe C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d"C:\Users\user\Desktop\dIg0MWRViP.exe"
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 544
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1032
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\soirllif\	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rdliobhf.exe" C:\Windows\SysWOW64\soirllif\	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description soirllif "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start soirllif	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 544	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1032	Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Unpacked PE file: 0.2.dIg0MWRViP.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Unpacked PE file: 11.2.rdliobhf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Unpacked PE file: 0.2.dIg0MWRViP.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Unpacked PE file: 11.2.rdliobhf.exe.400000.0.unpack

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_023818AE push 0000002Bh; iretd		0_2_023818B4
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_026FC7AE push 0000002Bh; iretd		11_2_026FC7B4

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\soirllif\rdliobhf.exe

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	File created: C:\Users\user\AppData\Local\Temp\rdliobhf.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\soirllif\rdliobhf.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\soirllif\rdliobhf.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\soirllif

Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\dig0mwrvip.exe

Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

12_2_02F1199C

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-16180
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15271
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-7856

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_12-6146

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-16020
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-7332
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-15948

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_11-14996
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-15063
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_12-7449

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_11-14878
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_12-6176
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14837

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	API coverage: 5.7 %
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	API coverage: 4.4 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7584	Thread sleep count: 39 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7584	Thread sleep time: -39000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 0000000C.00000002.2944653347.0000000003400000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	API call chain: ExitProcess graph end node			graph_0-15269
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_12-6180

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-7671
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_11-16241

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_0237DEA3 push dword ptr fs:[00000030h]	0_2_0237DEA3
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_024F092B mov eax, dword ptr fs:[00000030h]	0_2_024F092B
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_024F0D90 mov eax, dword ptr fs:[00000030h]	0_2_024F0D90
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_024C092B mov eax, dword ptr fs:[00000030h]	11_2_024C092B
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_024C0D90 mov eax, dword ptr fs:[00000030h]	11_2_024C0D90
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_026F8DA3 push dword ptr fs:[00000030h]	11_2_026F8DA3

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_0040EC2E GetProcessHeap,RtlFreeHeap,

0_2_0040EC2E

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_02F19A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_02F19A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.8.199.94 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2F10000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F10000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F10000			Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3084008			Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\soirllif\	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rdliobhf.exe" C:\Windows\SysWOW64\soirllif\	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description soirllif "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start soirllif	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 544	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1032	Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

0_2_00407809

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\dIg0MWRViP.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dIg0MWRViP.exe PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rdliobhf.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7392, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 11.2.rdliobhf.exe.24c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.24e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dIg0MWRViP.exe.3fa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rdliobhf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.2f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rdliobhf.exe.24e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dIg0MWRViP.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dIg0MWRViP.exe PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rdliobhf.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7392, type: MEMORYSTR

Source: C:\Users\user\Desktop\dIg0MWRViP.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\soirllif\rdliobhf.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_02F188B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_02F188B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
dIg0MWRViP.exe	34%	ReversingLabs
dIg0MWRViP.exe	41%	Virustotal	Browse
dIg0MWRViP.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\rdliobhf.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\rdliobhf.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta7.am0.yahoodns.net	1%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	15%	Virustotal	Browse
yahoo.com	1%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
google.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	URL Reputation	malware
jotunheim.name:443	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	217.69.139.150	true	true	0%, Virustotal, Browse	unknown
mta7.am0.yahoodns.net	67.195.228.94	true	true	1%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	104.47.53.36	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	141.8.199.94	true	true	15%, Virustotal, Browse	unknown
smtp.google.com	142.251.168.26	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	URL Reputation: malware	unknown
jotunheim.name:443	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.195.228.94	mta7.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
141.8.199.94	vanaheim.cn	Russian Federation	35278	SPRINTHOSTRU	true
142.251.168.26	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
104.47.53.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1444764
Start date and time:	2024-05-21 07:52:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dIg0MWRViP.exe renamed because original name is a hash value
Original Sample Name:	a6c7dd82eace106350d20d93956360e6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@30/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 253
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.236.44.162, 20.70.246.20, 20.231.239.246, 20.76.201.171
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:53:47	API Interceptor	12x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
67.195.228.94	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
141.8.199.94	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
	0bv3c9AqYs.exe	Get hash	malicious	Pushdo	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse
104.47.53.36	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.5284.17028.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta7.am0.yahoodns.net	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	SecuriteInfo.com.Win32.BotX-gen.31335.5127.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.111
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.77
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.204.79
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.91
	7b8wRbnmKu.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
microsoft-com.mail.protection.outlook.com	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	file.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.11.0
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
vanaheim.cn	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	file.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
mxs.mail.ru	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.69.139.150
	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse	94.100.180.31
	.exe	Get hash	malicious	Unknown	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	uUyFtCTKDd.elf	Get hash	malicious	Mirai	Browse	94.100.184.243
	https://www.ixxin.cn/go.html?url=https://ok.me/b5SG1?M6bxrJ9vlWS?MtRgHryntBJ	Get hash	malicious	GRQ Scam	Browse	217.20.155.6
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	c40snYcuW6.elf	Get hash	malicious	Mirai	Browse	5.61.23.80
	arm7.elf	Get hash	malicious	Mirai	Browse	217.69.134.17
	SkM9yWax29.elf	Get hash	malicious	Mirai	Browse	178.237.22.126
	base.apk	Get hash	malicious	Anubis BankBot	Browse	178.237.20.131
	UD6c1o6Fhg.elf	Get hash	malicious	Mirai	Browse	94.100.184.227
	BSKbaZ6Mij.elf	Get hash	malicious	Mirai	Browse	94.100.184.245
SPRINTHOSTRU	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	ckx1nc2UXk.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer, XWorm	Browse	141.8.192.103
	qxHQmnOvjL.exe	Get hash	malicious	DCRat	Browse	141.8.195.33
	9hupFTW1CI.exe	Get hash	malicious	DCRat	Browse	141.8.192.93
	l35QvlkTXb.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	WVswy22Yv1.exe	Get hash	malicious	DCRat	Browse	141.8.192.169
	Se7CZnlXZZ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	141.8.192.82
	R29s0ssNyZ.exe	Get hash	malicious	DCRat	Browse	141.8.192.126
	nXaujG6G1F.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	141.8.192.103
	n0mtzNARob.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
YAHOO-GQ1US	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
	n6UMcur8v3.elf	Get hash	malicious	Mirai	Browse	98.137.238.181
	zGP5DlrwgZ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.137.103.190
	9g5gIOlb47.elf	Get hash	malicious	Mirai	Browse	98.139.117.88
	https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB	Get hash	malicious	Unknown	Browse	98.136.144.138
	https://t.co/yKnQGIBNmn	Get hash	malicious	HTMLPhisher	Browse	74.6.160.138
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	z8s945rPmZ.exe	Get hash	malicious	SystemBC	Browse	67.195.12.34
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	q5C2tw1Pc6.elf	Get hash	malicious	Mirai	Browse	67.195.2.124
MICROSOFT-CORP-MSN-AS-BLOCKUS	PGA_Champ_2024_runde4.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	xfO72LuQ7K.elf	Get hash	malicious	Unknown	Browse	52.125.178.87
	zDAH4anUtC.elf	Get hash	malicious	Unknown	Browse	20.61.249.236
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	Lek#U00e9rdez#U00e9s 220062 .xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	FormBook	Browse	13.107.246.40
	PON2401071.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	Purchase order 0012May21-24.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	Plat#U0103 Factura MTL11852.xls	Get hash	malicious	Unknown	Browse	13.107.213.67
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	51.122.163.175

Process:	C:\Users\user\Desktop\dIg0MWRViP.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12872704
Entropy (8bit):	4.325440067725303
Encrypted:	false
SSDEEP:	3072:DpkXzxIGzA9aUo/PhcnVHUtoe5K9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9:+D+5+Q
MD5:	0E6E38A8AE20C869A188C52EA93ADF1C
SHA1:	F6F6E263C9177F84C34CDABC686B49A08D20E9C1
SHA-256:	EB54F57C84194A68A9458840C945D1B406F5D7A46C9F31C3BE357116B698A112
SHA-512:	B046EB35AE01E14E21B49494223EB97DE2CFB0F0F601994506369203A0A18D0B689C9E3E1BB95E510E651A2F0E00A8EE221FD8F9E0D0BEABA6DEBDB761B9DDD7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Bl.E,?.E,?.E,?V..?.E,?...?.E,?...?.E,?...?.E,?.W?.E,?.E-?.E,?...?.E,?...?.E,?...?.E,?Rich.E,?........................PE..L...=n^e.....................$....................@.................................GN..........................................P...................................................................................................................text............................... ..`.rdata..fc.......d..................@..@.data...\...........................@....rsrc...........F...&..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\soirllif\rdliobhf.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12872704
Entropy (8bit):	4.325440067725303
Encrypted:	false
SSDEEP:	3072:DpkXzxIGzA9aUo/PhcnVHUtoe5K9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9l9:+D+5+Q
MD5:	0E6E38A8AE20C869A188C52EA93ADF1C
SHA1:	F6F6E263C9177F84C34CDABC686B49A08D20E9C1
SHA-256:	EB54F57C84194A68A9458840C945D1B406F5D7A46C9F31C3BE357116B698A112
SHA-512:	B046EB35AE01E14E21B49494223EB97DE2CFB0F0F601994506369203A0A18D0B689C9E3E1BB95E510E651A2F0E00A8EE221FD8F9E0D0BEABA6DEBDB761B9DDD7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Bl.E,?.E,?.E,?V..?.E,?...?.E,?...?.E,?...?.E,?.W?.E,?.E-?.E,?...?.E,?...?.E,?...?.E,?Rich.E,?........................PE..L...=n^e.....................$....................@.................................GN..........................................P...................................................................................................................text............................... ..`.rdata..fc.......d..................@..@.data...\...........................@....rsrc...........F...&..............@..@........................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.830307196101327
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dIg0MWRViP.exe
File size:	182'272 bytes
MD5:	a6c7dd82eace106350d20d93956360e6
SHA1:	19c5ea0607b527e4c2b08a39583db38f503933e0
SHA256:	b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f
SHA512:	6e3d950e1a16103710985e9e0993f26ece5f7d67eadbd711941e826117d0d884624ddf166d3a70e25453518bb2f7d9a9c2dede25f6785dcb24d6031ba29c419e
SSDEEP:	1536:DAc76NGJEzLoCPMkXzxIGzA9aRmNjo/Phcnr6xMtxUtoIlESP5tA9bDQqpN+X:D7kXzxIGzA9aUo/PhcnVHUtoe5K9
TLSH:	27049E113A90D031ED9FC7364A25F2E09A2A7C61A7F1C19F3780767F1EB32D19A1A365
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Bl.E,?.E,?.E,?V..?.E,?...?.E,?...?.E,?...?.E,?..W?.E,?.E-?.E,?...?.E,?...?.E,?...?.E,?Rich.E,?........................PE..L..

File Icon


Icon Hash:	17794cb2b24d2117

Static PE Info

General

Entrypoint:	0x4015f7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x655E6E3D [Wed Nov 22 21:10:21 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3b7ea5b6d78948c9d917846499b5c3b5

Entrypoint Preview

Instruction
call 00007F09D0D27403h
jmp 00007F09D0D2374Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00423438h], eax
mov dword ptr [00423434h], ecx
mov dword ptr [00423430h], edx
mov dword ptr [0042342Ch], ebx
mov dword ptr [00423428h], esi
mov dword ptr [00423424h], edi
mov word ptr [00423450h], ss
mov word ptr [00423444h], cs
mov word ptr [00423420h], ds
mov word ptr [0042341Ch], es
mov word ptr [00423418h], fs
mov word ptr [00423414h], gs
pushfd
pop dword ptr [00423448h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0042343Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00423440h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042344Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00423388h], 00010001h
mov eax, dword ptr [00423440h]
mov dword ptr [0042333Ch], eax
mov dword ptr [00423330h], C0000409h
mov dword ptr [00423334h], 00000001h
mov eax, dword ptr [00421004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00421008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000B8h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1fa8c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f3e000	0xa0d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8fb6	0x9000	0bb4946e311cf63612d01d4dab8ce4c2	False	0.6155056423611112	data	6.618272611582304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x16366	0x16400	12433fd029d89a277d450fadb6e67a82	False	0.6130508251404494	data	5.989109722273131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x1f1c65c	0x2e00	c31f4d0bc90e337b0d41d4bf4e843872	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1f3e000	0xa0d0	0xa200	47c76288961dbb73abaabec0d427482b	False	0.35693962191358025	data	4.2869273185081225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1f44cb8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x1f44de8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x1f3e460	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.4205756929637527
RT_ICON	0x1f3f308	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.5361010830324909
RT_ICON	0x1f3fbb0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.5558755760368663
RT_ICON	0x1f40278	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.6033236994219653
RT_ICON	0x1f407e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.3771784232365145
RT_ICON	0x1f42d88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.4047842401500938
RT_ICON	0x1f43e30	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.4233606557377049
RT_ICON	0x1f447b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.44148936170212766
RT_DIALOG	0x1f475a0	0x98	data			0.7631578947368421
RT_STRING	0x1f47638	0xc0	data			0.546875
RT_STRING	0x1f476f8	0x446	data			0.4515539305301645
RT_STRING	0x1f47b40	0x4d8	data			0.4435483870967742
RT_STRING	0x1f48018	0xb6	data			0.5989010989010989
RT_ACCELERATOR	0x1f44c98	0x20	data			1.09375
RT_GROUP_CURSOR	0x1f47390	0x22	data			1.088235294117647
RT_GROUP_ICON	0x1f44c20	0x76	data	Turkish	Turkey	0.6610169491525424
RT_VERSION	0x1f473b8	0x1e4	data			0.5723140495867769

Imports

DLL	Import
KERNEL32.dll	GetNumaProcessorNode, CommConfigDialogA, SetErrorMode, InterlockedDecrement, ZombifyActCtx, SetConsoleScreenBufferSize, GetModuleHandleW, GetTickCount, GetProcessHeap, GetConsoleAliasesA, EnumTimeFormatsW, LoadLibraryW, Sleep, WriteConsoleOutputA, FindNextVolumeW, WriteConsoleW, CompareStringW, GetConsoleAliasesLengthW, VirtualUnlock, RaiseException, GetShortPathNameA, GetConsoleAliasesW, SetLastError, GetProcAddress, VerLanguageNameW, BuildCommDCBW, LoadLibraryA, FreeEnvironmentStringsW, PurgeComm, GetCurrentDirectoryA, DeleteCriticalSection, SetCalendarInfoA, GlobalReAlloc, SetConsoleTitleA, SetLocaleInfoA, HeapAlloc, GetLastError, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapCreate, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, CreateFileA, CloseHandle, FlushFileBuffers
USER32.dll	UpdateWindow
ADVAPI32.dll	EnumDependentServicesW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 07:53:05.362904072 CEST	49731	25	192.168.2.4	104.47.53.36
May 21, 2024 07:53:06.370826006 CEST	49731	25	192.168.2.4	104.47.53.36
May 21, 2024 07:53:08.206808090 CEST	49732	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:08.206888914 CEST	443	49732	141.8.199.94	192.168.2.4
May 21, 2024 07:53:08.206983089 CEST	49732	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:08.371090889 CEST	49731	25	192.168.2.4	104.47.53.36
May 21, 2024 07:53:12.370805025 CEST	49731	25	192.168.2.4	104.47.53.36
May 21, 2024 07:53:20.370709896 CEST	49731	25	192.168.2.4	104.47.53.36
May 21, 2024 07:53:25.388067961 CEST	49739	25	192.168.2.4	67.195.228.94
May 21, 2024 07:53:26.402256012 CEST	49739	25	192.168.2.4	67.195.228.94
May 21, 2024 07:53:28.417609930 CEST	49739	25	192.168.2.4	67.195.228.94
May 21, 2024 07:53:32.433341026 CEST	49739	25	192.168.2.4	67.195.228.94
May 21, 2024 07:53:40.448976994 CEST	49739	25	192.168.2.4	67.195.228.94
May 21, 2024 07:53:45.403716087 CEST	49740	25	192.168.2.4	142.251.168.26
May 21, 2024 07:53:46.401987076 CEST	49740	25	192.168.2.4	142.251.168.26
May 21, 2024 07:53:48.216392994 CEST	49732	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:48.216485977 CEST	443	49732	141.8.199.94	192.168.2.4
May 21, 2024 07:53:48.216553926 CEST	49732	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:48.324961901 CEST	49741	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:48.325057030 CEST	443	49741	141.8.199.94	192.168.2.4
May 21, 2024 07:53:48.325145960 CEST	49741	443	192.168.2.4	141.8.199.94
May 21, 2024 07:53:48.401992083 CEST	49740	25	192.168.2.4	142.251.168.26
May 21, 2024 07:53:52.402172089 CEST	49740	25	192.168.2.4	142.251.168.26
May 21, 2024 07:54:00.402035952 CEST	49740	25	192.168.2.4	142.251.168.26
May 21, 2024 07:54:05.418873072 CEST	49743	25	192.168.2.4	217.69.139.150
May 21, 2024 07:54:06.433290005 CEST	49743	25	192.168.2.4	217.69.139.150
May 21, 2024 07:54:08.449049950 CEST	49743	25	192.168.2.4	217.69.139.150
May 21, 2024 07:54:12.448959112 CEST	49743	25	192.168.2.4	217.69.139.150
May 21, 2024 07:54:20.449269056 CEST	49743	25	192.168.2.4	217.69.139.150
May 21, 2024 07:54:28.339730978 CEST	49741	443	192.168.2.4	141.8.199.94
May 21, 2024 07:54:28.339839935 CEST	443	49741	141.8.199.94	192.168.2.4
May 21, 2024 07:54:28.339911938 CEST	49741	443	192.168.2.4	141.8.199.94
May 21, 2024 07:54:28.449723959 CEST	49744	443	192.168.2.4	141.8.199.94
May 21, 2024 07:54:28.449752092 CEST	443	49744	141.8.199.94	192.168.2.4
May 21, 2024 07:54:28.449837923 CEST	49744	443	192.168.2.4	141.8.199.94

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 07:53:05.114269972 CEST	56540	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:05.361886024 CEST	53	56540	1.1.1.1	192.168.2.4
May 21, 2024 07:53:08.043701887 CEST	59894	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:08.206214905 CEST	53	59894	1.1.1.1	192.168.2.4
May 21, 2024 07:53:25.371529102 CEST	60341	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:25.378815889 CEST	53	60341	1.1.1.1	192.168.2.4
May 21, 2024 07:53:25.379499912 CEST	62594	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:25.387541056 CEST	53	62594	1.1.1.1	192.168.2.4
May 21, 2024 07:53:45.386902094 CEST	53019	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:45.394581079 CEST	53	53019	1.1.1.1	192.168.2.4
May 21, 2024 07:53:45.395425081 CEST	52021	53	192.168.2.4	1.1.1.1
May 21, 2024 07:53:45.403125048 CEST	53	52021	1.1.1.1	192.168.2.4
May 21, 2024 07:54:05.402614117 CEST	60831	53	192.168.2.4	1.1.1.1
May 21, 2024 07:54:05.409778118 CEST	53	60831	1.1.1.1	192.168.2.4
May 21, 2024 07:54:05.410526991 CEST	55798	53	192.168.2.4	1.1.1.1
May 21, 2024 07:54:05.418091059 CEST	53	55798	1.1.1.1	192.168.2.4
May 21, 2024 07:55:06.534887075 CEST	51094	53	192.168.2.4	1.1.1.1
May 21, 2024 07:55:06.612116098 CEST	53	51094	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 21, 2024 07:53:05.114269972 CEST	192.168.2.4	1.1.1.1	0xbf0e	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:08.043701887 CEST	192.168.2.4	1.1.1.1	0x893e	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.371529102 CEST	192.168.2.4	1.1.1.1	0x133e	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:25.379499912 CEST	192.168.2.4	1.1.1.1	0x3f98	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.386902094 CEST	192.168.2.4	1.1.1.1	0x93ad	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:45.395425081 CEST	192.168.2.4	1.1.1.1	0x1877	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
May 21, 2024 07:54:05.402614117 CEST	192.168.2.4	1.1.1.1	0xe9c8	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:54:05.410526991 CEST	192.168.2.4	1.1.1.1	0x8fa5	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 21, 2024 07:55:06.534887075 CEST	192.168.2.4	1.1.1.1	0x7979	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 21, 2024 07:53:05.361886024 CEST	1.1.1.1	192.168.2.4	0xbf0e	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:05.361886024 CEST	1.1.1.1	192.168.2.4	0xbf0e	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:08.206214905 CEST	1.1.1.1	192.168.2.4	0x893e	No error (0)	vanaheim.cn	141.8.199.94	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.378815889 CEST	1.1.1.1	192.168.2.4	0x133e	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:25.378815889 CEST	1.1.1.1	192.168.2.4	0x133e	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:25.378815889 CEST	1.1.1.1	192.168.2.4	0x133e	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	67.195.228.111	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:25.387541056 CEST	1.1.1.1	192.168.2.4	0x3f98	No error (0)	mta7.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.394581079 CEST	1.1.1.1	192.168.2.4	0x93ad	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:53:45.403125048 CEST	1.1.1.1	192.168.2.4	0x1877	No error (0)	smtp.google.com	142.251.168.26	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.403125048 CEST	1.1.1.1	192.168.2.4	0x1877	No error (0)	smtp.google.com	142.250.110.26	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.403125048 CEST	1.1.1.1	192.168.2.4	0x1877	No error (0)	smtp.google.com	142.251.168.27	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.403125048 CEST	1.1.1.1	192.168.2.4	0x1877	No error (0)	smtp.google.com	142.250.110.27	A (IP address)	IN (0x0001)	false
May 21, 2024 07:53:45.403125048 CEST	1.1.1.1	192.168.2.4	0x1877	No error (0)	smtp.google.com	142.251.5.27	A (IP address)	IN (0x0001)	false
May 21, 2024 07:54:05.409778118 CEST	1.1.1.1	192.168.2.4	0xe9c8	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
May 21, 2024 07:54:05.418091059 CEST	1.1.1.1	192.168.2.4	0x8fa5	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
May 21, 2024 07:54:05.418091059 CEST	1.1.1.1	192.168.2.4	0x8fa5	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
May 21, 2024 07:55:06.612116098 CEST	1.1.1.1	192.168.2.4	0x7979	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
May 21, 2024 07:55:06.612116098 CEST	1.1.1.1	192.168.2.4	0x7979	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	01:52:59
Start date:	21/05/2024
Path:	C:\Users\user\Desktop\dIg0MWRViP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dIg0MWRViP.exe"
Imagebase:	0x400000
File size:	182'272 bytes
MD5 hash:	A6C7DD82EACE106350D20D93956360E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1683260511.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:53:00
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\soirllif\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:53:00
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:53:01
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rdliobhf.exe" C:\Windows\SysWOW64\soirllif\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:53:01
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:53:01
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create soirllif binPath= "C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d\"C:\Users\user\Desktop\dIg0MWRViP.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:53:01
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:53:02
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description soirllif "wifi internet conection"
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:53:02
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start soirllif
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\soirllif\rdliobhf.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\soirllif\rdliobhf.exe /d"C:\Users\user\Desktop\dIg0MWRViP.exe"
Imagebase:	0x400000
File size:	12'872'704 bytes
MD5 hash:	0E6E38A8AE20C869A188C52EA93ADF1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1727919607.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1719474471.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x420000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7372 -ip 7372
Imagebase:	0xab0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436
Imagebase:	0xab0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:53:03
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 544
Imagebase:	0xab0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:53:04
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 1032
Imagebase:	0xab0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	25.6%
Total number of Nodes:	1549
Total number of Limit Nodes:	16

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
P, xrefs: 00409DAA
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
D, xrefs: 00409F8E
", xrefs: 00409EDB
", xrefs: 0040A078
\, xrefs: 00409D0C

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 085b9d8147ae087c2ec6eca2e308c88e62f1e09930a9d5b1f46d7a4f91e91af0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 085b9d8147ae087c2ec6eca2e308c88e62f1e09930a9d5b1f46d7a4f91e91af0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
PDu, xrefs: 0040139A
D, xrefs: 004015C6
<, xrefs: 00401378
@, xrefs: 00401380
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
, xrefs: 00401462

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 02aec6f577dd688fddbb5344b15a6666d7f538056132fce720943a2534271e66
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: 02aec6f577dd688fddbb5344b15a6666d7f538056132fce720943a2534271e66
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0040EC0A,00000000,80000001,?,0040DB55,7FFF0001), ref: 0040EBAD
Part of subcall function 0040EBA0: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBB4

GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

'@, xrefs: 0040EC2F, 0040EC37, 0040EC3E

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: '@
API String ID: 1305341483-3530194223
Opcode ID: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction ID: 2d0ac8bb9d02bc94818634b60920d143dc176b06b32ab47b2cd542b2b5f2599d
Opcode Fuzzy Hash: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction Fuzzy Hash: 3AC012324062307BD5512751BC0DFDB7B28AF45711F0D481AF40576194C7BD588046ED

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 0237E5C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0237E5EE
Module32First.KERNEL32(00000000,00000224), ref: 0237E60E

Memory Dump Source

Source File: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_237d000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9684589b266cdf2dc51969da3a6cb458effc4ba55b1836d816285883010eb8fa
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 20F096352007146FDB303BF5988CF6E76E8AF49625F1005A8F642954C1DB74E8454A65

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: d1745f93e4738621f3a81734226608b64e23a07a53a3347429d52bf37170d4a4
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: d1745f93e4738621f3a81734226608b64e23a07a53a3347429d52bf37170d4a4
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 5af9527d081b75e26a8274f62d41663e3dd5d5ca7bdbbab9435bf0acb249f6fa
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 5af9527d081b75e26a8274f62d41663e3dd5d5ca7bdbbab9435bf0acb249f6fa
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 024F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024F024D

Strings

cess, xrefs: 024F018D
kernel32.dll, xrefs: 024F008F, 024F0095

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fbf06393b412c87a3d50d88f0dbf1f48102c0f1d04f45ddb18649da5986a0ba6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3E526D74A01229DFDBA4CF58C984BADBBB1BF49304F1480DAE54DA7356DB30AA85CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: b0aa9981bb4070313baffe29f7f8b6c817e0d26ac6bef10e6311cdec87a803e2
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: b0aa9981bb4070313baffe29f7f8b6c817e0d26ac6bef10e6311cdec87a803e2
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 024F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024F0223,?,?), ref: 024F0E19
SetErrorMode.KERNELBASE(00000000,?,?,024F0223,?,?), ref: 024F0E1E

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a1355340812a76edfb87e8f37077e87cd166259ba3829630d5b4c7a92252a5d3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 52D01231545128B7D7402A94DC09BCE7B1CDF45B66F008011FB0DD9181C770954046E5

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 0237E285 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0237E2D6

Memory Dump Source

Source File: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_237d000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 13ffb1ce202b867ae563f450ee37ee012343362e715be5fc4ef7c8e396cff984
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E6113C79A00208EFDB11DF98C985E98BFF5AF08351F058094F9489B361D375EA50EF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

srv_time, xrefs: 0040CABB
flags_upd, xrefs: 0040CE4A
wtm_w, xrefs: 0040C96C
drivers\, xrefs: 0040D067
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
.sys, xrefs: 0040D0CC
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
local_time, xrefs: 0040CACD
\, xrefs: 0040D39D
@, xrefs: 0040D754
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
wtm_r, xrefs: 0040C97F
4, xrefs: 0040D9F7
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
wtm_c, xrefs: 0040C956
\, xrefs: 0040D3A7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
lid_file_upd, xrefs: 0040CE6A
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 5ee263308baf86ce489a886349a9e37e750b35b75793d61b0b45e95a18e734f4
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 5ee263308baf86ce489a886349a9e37e750b35b75793d61b0b45e95a18e734f4
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtTerminateProcess, xrefs: 004010F6
NtSetInformationToken, xrefs: 00401175
NtOpenProcessToken, xrefs: 004011D4
RtlFreeSid, xrefs: 00401116
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlNtStatusToDosError, xrefs: 00401194
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtFilterToken, xrefs: 0040122B
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
NtClose, xrefs: 004011B4
RtlLengthSid, xrefs: 00401246
RtlSetLastWin32Error, xrefs: 004010D6
NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Dec, xrefs: 0040B2A3
Tue, xrefs: 0040B233
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Feb, xrefs: 0040B25D
Sat, xrefs: 0040B24F
Mon, xrefs: 0040B22C
Nov, xrefs: 0040B29C
Sun, xrefs: 0040B225
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Sep, xrefs: 0040B28E
Oct, xrefs: 0040B295
Jun, xrefs: 0040B279
Aug, xrefs: 0040B287
May, xrefs: 0040B272
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
Mar, xrefs: 0040B264
Wed, xrefs: 0040B23A

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2
born_date, xrefs: 00401EAD, 00401ECC
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
start_srv, xrefs: 00401E6C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
loader_id, xrefs: 00401F4B, 00401F6B
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 110b6dfce453f86d90b76d90b4f40e7d8c24a5c0218ad8ac054d44c6fd0a90ba
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 110b6dfce453f86d90b76d90b4f40e7d8c24a5c0218ad8ac054d44c6fd0a90ba
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: ac048a5111c4c0facacafd4696e747130b11041e76af35315694b4682072b2fe
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: ac048a5111c4c0facacafd4696e747130b11041e76af35315694b4682072b2fe
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: db7f5c645f4a165619cd73390d37071b2a25bff7da9d907bf9deffaa756c70e2
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: db7f5c645f4a165619cd73390d37071b2a25bff7da9d907bf9deffaa756c70e2
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 024F65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 024F65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024F6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 024F6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 024F6652

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 27cab6013b85eb5c5bffe58820841bee06a415e93b3e3a7b3b3167204318af1b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: B511A771600218BFEB515F65DC05F9B3FACEB44BA5F014025FA14E7250D7B1DD008AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: f6eca2d635dad700dab7ba812a98c92b25c767b6f83168f66ca2aac5250ba8f9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: f6eca2d635dad700dab7ba812a98c92b25c767b6f83168f66ca2aac5250ba8f9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 024F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 024F095F
l, xrefs: 024F0966
GetProcAddress., xrefs: 024F09DC, 024F09DF, 024F09E4

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 8cc2ddee45e4730f41419645bc1fe682aa102da875142fd5a7aad30607f3018e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 41318AB6900609CFEB10CF99C880AAEBBF9FF88324F14504AD941A7315D771EA45CFA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c004fe6a7d2a155bcd88644f0f92c807432d7dbe6f22548f72735b6b43e23c
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: 06c004fe6a7d2a155bcd88644f0f92c807432d7dbe6f22548f72735b6b43e23c
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 0237DEA3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729000703.000000000237D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_237d000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 83f51195e5bb528f2f8f12a87505701ddf1f22c489f95be6f8dbd6be43ebf3e9
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 74117C72340204AFDB64DE55DC80EA673EAEF99620B1980A5ED08CB716D779E842CB60

Function 024F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a1c71ae27c6bec535a0940fb186207137ad1d37a2fc915d52da6caf67d1247ae
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0D01F273A116008FDF61CF20C904BAB33E9FBC6206F0550A6DA0A9738AE370A8418B80

Function 024F9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 024F9E6D
lstrcpy.KERNEL32(?,00000000), ref: 024F9FE1
lstrcat.KERNEL32(?,?), ref: 024F9FF2
lstrcat.KERNEL32(?,0041070C), ref: 024FA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 024FA054
DeleteFileA.KERNEL32(?), ref: 024FA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 024FA0D6
lstrcpy.KERNEL32 ref: 024FA12F
lstrlen.KERNEL32(00000022), ref: 024FA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 024F9F13

Part of subcall function 024F7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 024F7081

Part of subcall function 024F6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eaudxxur,024F7043), ref: 024F6F4E
Part of subcall function 024F6F30: GetProcAddress.KERNEL32(00000000), ref: 024F6F55
Part of subcall function 024F6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024F6F7B
Part of subcall function 024F6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024F6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 024FA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024FA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 024FA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 024FA21B
GetDriveTypeA.KERNEL32(?), ref: 024FA265
lstrcat.KERNEL32(?,00000000), ref: 024FA29F
lstrcat.KERNEL32(?,00410A34), ref: 024FA2C5
lstrcat.KERNEL32(?,00000022), ref: 024FA2D9
lstrcat.KERNEL32(?,00410A34), ref: 024FA2F4
wsprintfA.USER32 ref: 024FA31D
lstrcat.KERNEL32(?,00000000), ref: 024FA345
lstrcat.KERNEL32(?,?), ref: 024FA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 024FA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 024FA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024FA1D1

Part of subcall function 024F9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024F999D
Part of subcall function 024F9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 024F99BD
Part of subcall function 024F9966: RegCloseKey.ADVAPI32(?), ref: 024F99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 024FA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 024FA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 024FA41D

Strings

", xrefs: 024FA3F0
D, xrefs: 024FA1F5
\, xrefs: 024F9F73
", xrefs: 024FA142
P, xrefs: 024FA011
", xrefs: 024FA2DF

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: bf7d0c391061cdff028913eb27c40a402faff4eed16d80f8600fcca9b42e50ca
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 9EF153B1D40259AFDF61DBA0DC48FEF7BBCAB48304F0440AAE709E2141E7B586858F65

Function 024F7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 024F7D21
GetUserNameA.ADVAPI32(?,?), ref: 024F7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 024F7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024F7DC0
EqualSid.ADVAPI32(?,?), ref: 024F7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024F7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 024F7E12
LocalFree.KERNEL32(00000000), ref: 024F7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024F7E35

Strings

PromptOnSecureDesktop, xrefs: 024F7FA0
D, xrefs: 024F7D73

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 1441937d74dc65ba5814485312ffec28e4fbc7986d073e480e555acb78138403
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 82A16E71900209AFDB518FA0DD88FEFBFB9FB48304F04816AE605E6250E7758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
Jan 13 2018, xrefs: 0040653A
localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b207dd172069646c24aed32b1972735792d3f59ccf14c8b8a18c1bcf80ec5da1
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b207dd172069646c24aed32b1972735792d3f59ccf14c8b8a18c1bcf80ec5da1
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
mail from:<%s>, xrefs: 0040A848
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
data, xrefs: 0040A85E
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Too small respons, xrefs: 0040A9C9
quit, xrefs: 0040A86C
., xrefs: 0040A8CA
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 024F7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024F7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7ACD
GetLengthSid.ADVAPI32(?), ref: 024F7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 024F7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024F7B1F
EqualSid.ADVAPI32(?,?), ref: 024F7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024F7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 024F7B77
LocalFree.KERNEL32(00000000), ref: 024F7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024F7B9A
GetAce.ADVAPI32(?,?,?), ref: 024F7BCA
EqualSid.ADVAPI32(?,?), ref: 024F7BF1
DeleteAce.ADVAPI32(?,?), ref: 024F7C0A
EqualSid.ADVAPI32(?,?), ref: 024F7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 024F7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 024F7CE0
LocalFree.KERNEL32(00000000), ref: 024F7CEE

Strings

D, xrefs: 024F7AC3

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 55367e2dc6caccfa52f05685572d25ec9026ae9b0629e6e6dd61d30a39351a76
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B8815D71900259AFEB51CFA4DD84FEFBBB8EF48304F04806AE605E6250D7798681CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: 9998f99baa3e35f42d7690d30857871b25eda7064f5d7260055e25c792b185e5
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9998f99baa3e35f42d7690d30857871b25eda7064f5d7260055e25c792b185e5
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 024F858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 024F865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 024F867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 024F86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 024F86B1

Strings

", xrefs: 024F896C
PromptOnSecureDesktop, xrefs: 024F85B6, 024F8645, 024F86BD, 024F8708, 024F87C5, 024F8812, 024F88E9, 024F8905

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f3aa70a5eba402f650266a0e1d6d9f756bb6284a8b419a97865b093a981d91bc
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: D2C191B2900149BFEB51ABA4DD84EEF7BBDEB84304F14406BF704EA150E7B04A948F65

Function 024F14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 024F1601
lstrlenW.KERNEL32(-00000003), ref: 024F17D8

Strings

@, xrefs: 024F15E7
, xrefs: 024F16C9
D, xrefs: 024F182D
<, xrefs: 024F15DF

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: f4d1a6300ba202540b5e8f883527a1f752ef79c049d4e5137a6afa3d06c12475
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 1AF138B1508341DFD720DF64C888AABB7E5FBC8305F00892EFA9997390D7B49944CB66

Function 024F7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024F76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 024F7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 024F778F
___ascii_stricmp.LIBCMT ref: 024F78B4
RegCloseKey.ADVAPI32(?), ref: 024F794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024F796D
RegCloseKey.ADVAPI32(?), ref: 024F797E
RegCloseKey.ADVAPI32(?), ref: 024F79AC
RegCloseKey.ADVAPI32(?), ref: 024F7A56

Part of subcall function 024FF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,024F772A,?), ref: 024FF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 024F79F6
RegCloseKey.ADVAPI32(?), ref: 024F7A4D

Strings

PromptOnSecureDesktop, xrefs: 024F76C5, 024F76CA, 024F76E5, 024F7782, 024F77E6, 024F7862, 024F787B, 024F79C2
", xrefs: 024F7800

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 81ad110082cff91c28e047ef74f734b7936b3517d77cf77b3a800cf6e4774b84
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: F3C18571900209AFEB51DBA5DC44FEFBBB9EF89710F1140A7E604E6190EB759A84CF60

Function 024F2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 024F2CED
socket.WS2_32(00000002,00000002,00000011), ref: 024F2D07
htons.WS2_32(00000000), ref: 024F2D42
select.WS2_32 ref: 024F2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 024F2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024F2E62

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 8d26452d8de5cee50ac0cb9b522a8e7fb290aa63a477adde45208256b8fb0e06
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 6461DF71904305ABC360DF61DC08B6BBBE8FB88745F15481AFE8597250E7F5D881CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 7bbacfd63cc1bd3358eb6f9f25528e70d4a402c133def0f16d35053a1172090f
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 7bbacfd63cc1bd3358eb6f9f25528e70d4a402c133def0f16d35053a1172090f
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 024F958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 024F95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024F95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 024F95DC
wsprintfA.USER32 ref: 024F9635
wsprintfA.USER32 ref: 024F9673
wsprintfA.USER32 ref: 024F96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 024F9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024F978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024F97D8

Strings

PromptOnSecureDesktop, xrefs: 024F9604, 024F9624, 024F9662, 024F9683, 024F96B6, 024F96DF, 024F9701, 024F9734, 024F9780, 024F97B7

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: c62da10363847511f7d41fb28b29905a10d214479ad9571535335d696d760b4f
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: E2A16AB2900608FBEB61DFA1CC45FDB3BADAB84740F10402BFA1596251E7B5D584CFA5

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: c846f043494d1212c12cca3077d5224032b1241b6052029cc8ab7cf3cda5ab79
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: c846f043494d1212c12cca3077d5224032b1241b6052029cc8ab7cf3cda5ab79
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%s@%s, xrefs: 0040B461
%FROM_USER, xrefs: 0040B431
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%TO_DOMAIN, xrefs: 0040B44B

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: f6bf990b8d2e0653f7ce57bc0c35302b71962c3564253f9b7ed5e4bc4b128e8d
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: f6bf990b8d2e0653f7ce57bc0c35302b71962c3564253f9b7ed5e4bc4b128e8d
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 024F3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 024F3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 024F3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 024F3095
RtlAllocateHeap.NTDLL(00000000), ref: 024F30B6
htons.WS2_32(00000035), ref: 024F30EF
inet_addr.WS2_32(?), ref: 024F30FA
gethostbyname.WS2_32(?), ref: 024F310D
HeapFree.KERNEL32(00000000), ref: 024F314D

Strings

iphlpapi.dll, xrefs: 024F3062, 024F3067, 024F3077

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b5941bdf0e5a18d3ca32d5ad44bfc31c8debd8c0750dd4b3e60d2b76f2e39b52
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 5231C731A00246ABDB929FB49D48BAF7F78EF44364F1441A7E618E3390DB74D541CB58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: 0cf6a8701cb8f0680dc0f016b74236af14a98fd9df1df95cbda4f4d63be35472
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: 0cf6a8701cb8f0680dc0f016b74236af14a98fd9df1df95cbda4f4d63be35472
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 95e7c86f2c9233c41f1e2c53a6d570cd49a4b83f91fe69b21a1c821a086f9375
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 95e7c86f2c9233c41f1e2c53a6d570cd49a4b83f91fe69b21a1c821a086f9375
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: db8e7b4b42e65af80add877bb874c42dec97f5f82b139a1a33863129b24a212d
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: db8e7b4b42e65af80add877bb874c42dec97f5f82b139a1a33863129b24a212d
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 024F6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 024F67C3
htonl.WS2_32(?), ref: 024F67DF
htonl.WS2_32(?), ref: 024F67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 024F68F1
ExitProcess.KERNEL32 ref: 024F69BC

Strings

localcfg, xrefs: 024F6994
except_info, xrefs: 024F698F

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 0e70a0c211c851caf44840e893623a4cec965050d5488d61d3f5b052dbc368d2
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: E4616E71A40208AFDB609FB4DC45FEA77E9FB48300F14806AFA6DD2161EB7599908F14

Function 024FF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(024FCC84), ref: 024FF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 024FF5CE
closesocket.WS2_32(00000000), ref: 024FF5DC

Strings

time_cfg, xrefs: 024FF58A

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a829de05e2eba03b54815dd0ff9ee2fe8db07ce13d9aef3e8d33ae16f26a9663
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: E3316071900118ABDB50DFA5DC84DEF7BBCEF88710F11456AFA15D3190E7709A86CBA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 024F2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 024F2FA1
LoadLibraryA.KERNEL32(?), ref: 024F2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 024F2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024F3000
RtlAllocateHeap.NTDLL(00000000), ref: 024F3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 024F3032

Strings

dnsapi.dll, xrefs: 024F2F90

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 2c59d0c05404c5f111d6e5b042553de91452c6174e488aef36d94586a3a6b15f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8F219271D40226BBCB619F55DC44AAFBFB8EF48B10F014462FA01E7640D7B49AC18BE4

Function 024F6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eaudxxur,024F7043), ref: 024F6F4E
GetProcAddress.KERNEL32(00000000), ref: 024F6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024F6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024F6F92

Strings

\\.\pipe\eaudxxur, xrefs: 024F6F37
C:\Windows\SysWOW64\, xrefs: 024F6F30, 024F6F38, 024F6F65, 024F6F6C, 024F6F7A, 024F6F85, 024F6F91, 024F6FA9, 024F6FC6, 024F6FEC
PromptOnSecureDesktop, xrefs: 024F6F9D, 024F6FBF, 024F6FCF, 024F6FE5, 024F6FF5

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\eaudxxur
API String ID: 1082366364-178168089
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 0fa34587edd491e716f7d1618f33a3e59758859a38f8c42be2438947ca87c465
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: B421F2217403403EF7A257319C88FBB2A4C8F92714F1A40AAFA0495AD0DBD984DA8A7D

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 024F92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 024F92E2
wsprintfA.USER32 ref: 024F9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024F9375
lstrlen.KERNEL32(?,?,00000000), ref: 024F9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 024F9394
CloseHandle.KERNEL32(00000000), ref: 024F939B

Strings

PromptOnSecureDesktop, xrefs: 024F932B, 024F9343, 024F935E

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 00e0c5956023fe4b07fbb779d4e377da03230f15907cf86a314cb9cc18d752be
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: EE119AB57401147BE7606732DC0DFEF3A6EDFC8B11F01C06ABB06E5090EAB44A458A75

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 730725e1a30653b3eba158ee6b5a706d92185f15afc7f0cb0d565943f0052150
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: 730725e1a30653b3eba158ee6b5a706d92185f15afc7f0cb0d565943f0052150
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 024F99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 024F9A18
GetThreadContext.KERNEL32(?,?), ref: 024F9A52
TerminateProcess.KERNEL32(?,00000000), ref: 024F9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 024F9A98
SetThreadContext.KERNEL32(?,00010002), ref: 024F9AB5
ResumeThread.KERNEL32(?), ref: 024F9AC2

Strings

D, xrefs: 024F9A10

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f7f3f54aa703419f78af6d8174274fff446d7e0cc361af7e5f57a851cc2c0ba7
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 60213BB1E01229BBDB619BA1DC09FEF7BBCEF44750F404062BA19E1150E7758A84CBA4

Function 024F1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 024F1C18
LoadLibraryA.KERNEL32(004102C8), ref: 024F1C26
GetProcessHeap.KERNEL32 ref: 024F1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 024F1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 024F1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 024F1D02
FreeLibrary.KERNEL32(?), ref: 024F1D0B

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 58d04e133c32add87a4f6a944e0ec9dcd761273cee871b8b98abb98e1666041a
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: D3315E32D00249FFCB519FA4DC888AFBAB9EB85705B24447BE609A2210D7B55E80DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 024F6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 024F6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 024F6D22
GetLastError.KERNEL32 ref: 024F6DA7
CloseHandle.KERNEL32(?), ref: 024F6DB5
GetLastError.KERNEL32 ref: 024F6DD6
DeleteFileA.KERNEL32(?), ref: 024F6DE7
GetLastError.KERNEL32 ref: 024F6DFD

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 46d94ca98cbaa321f52e1f5e2f7c8e1286a166fefbeaa3efd10aa1a04272255d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: E431EE73900249BFCB419FA59D48ADF7F7DEB88300F16816AE321A3220D7708A858B61

Function 024F93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024F93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 024F93CD
CharToOemA.USER32(?,?), ref: 024F93DB
wsprintfA.USER32 ref: 024F9410

Part of subcall function 024F92CB: GetTempPathA.KERNEL32(00000400,?), ref: 024F92E2
Part of subcall function 024F92CB: wsprintfA.USER32 ref: 024F9350
Part of subcall function 024F92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024F9375
Part of subcall function 024F92CB: lstrlen.KERNEL32(?,?,00000000), ref: 024F9389
Part of subcall function 024F92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 024F9394
Part of subcall function 024F92CB: CloseHandle.KERNEL32(00000000), ref: 024F939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 024F9448

Strings

PromptOnSecureDesktop, xrefs: 024F93FA, 024F93FF, 024F941C

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 7aa64262734e9c28a7cde013a6e2a3c02bd3f6b9aa9b44ac7b0a71dbe2d4fabe
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: A4015EF69001187BDB61A7619D89FDF3B7CDBD5701F0040A6BB49E2080EAB496C98F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 45fddde66681fcd1d10412195ca3cbb3a67b5acc72870ab1a948a161cfab8417
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 45fddde66681fcd1d10412195ca3cbb3a67b5acc72870ab1a948a161cfab8417
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 024FAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 024FAAE5

Strings

, xrefs: 024FABB3
localcfg, xrefs: 024FAD72

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 1bce074a5de0d44bb125ee1f6e55e93cf9469f5f2bfa0e6d82615cb31421aafb
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 5A712B72A00364ABDFA19B54DC85FEF376AABC0749F244027FB0CA61D0DF6199C88B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 024FE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024FDF6C: GetCurrentThreadId.KERNEL32 ref: 024FDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 024FE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,024F6128), ref: 024FE950
lstrcmp.KERNEL32(?,00000008), ref: 024FE989

Strings

A, xrefs: 024FE9A0
A, xrefs: 024FE8C6, 024FE8CD, 024FE936, 024FE998
A, xrefs: 024FE960, 024FE965

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: dadaf5de2ed26876fb454433dc0f7590e0106b56fee411f013dd345338b3e8bb
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: A1319231B00705DBDBB18F25C884FAB7BE5EB85726F00852BEB5587661D370E480CBA1

Function 024F6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 024F6E19

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 30ab593c2473aebfd1d45b0ea47de3bac8974f8690fb089cbf03723c8bf40b88
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 04215C73204219BFDB509BB1FC48EDF7FADEB89265B118426F612D10A0FB71DA409A74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 024FC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024FC6B4
InterlockedIncrement.KERNEL32(024FC74B), ref: 024FC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,024FC747), ref: 024FC728
CloseHandle.KERNEL32(00000000,?,024FC747,00413588,024F8A77), ref: 024FC733

Strings

localcfg, xrefs: 024FC544

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: d800eaceae510e1df57b912a0c9065c9211c0c13b61362d09497bacd5537fa87
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 97514CB1A04B458FD7A4CF29C5C462ABBE9FB88704B50693FE28BC7A90D774E444CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: ae68541743c3be3a909adc74ff35c87c840d37b8f53cb495da4a43f3a1185c7f
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: ae68541743c3be3a909adc74ff35c87c840d37b8f53cb495da4a43f3a1185c7f
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 024FE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,024FE50A,00000000,00000000,00000000,00020106,00000000,024FE50A,00000000,000000E4), ref: 024FE319
RegSetValueExA.ADVAPI32(024FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024FE38E
RegDeleteValueA.ADVAPI32(024FE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024FE3BF
RegCloseKey.ADVAPI32(024FE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,024FE50A), ref: 024FE3C8

Strings

PromptOnSecureDesktop, xrefs: 024FE33A

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 961e00fdc4dfd9beae16d4dcc7fc12e15c1089d0304f5a021ebde7572bae9d7d
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 3A214F71A0021DABDF609FA5EC89EDF7F79EF48750F048026FA04E6160E3B19A54DB91

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 024F71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024F71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7228
LocalFree.KERNEL32(?,?,?), ref: 024F7286
wsprintfA.USER32 ref: 024F729D

Strings

|, xrefs: 024F721A

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 37e515816f8ccd3fd5b0a66c7130925b7837e47e00d98b9a33afabb3d3c56606
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9D313872A00208BFDB41DFA8DC44BDB7BACEF44314F148066F959DB240EB79D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 024FB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024FB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 024FB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 024FB548
GetTimeZoneInformation.KERNEL32(?), ref: 024FB590
wsprintfA.USER32 ref: 024FB61E

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 7c1e5bd8289b24d1cd9650f3b7a713fa30cfff52a6da8684ce552db02d8485b7
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 375111B1D0021DAACF54DFD5D8445EEBBB9FF49308F10816BE605A6150E7B84AC9CF98

Function 024F62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 024F6303
LoadLibraryA.KERNEL32(?), ref: 024F632A
GetProcAddress.KERNEL32(00000000,?), ref: 024F63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 024F6405

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 4fd8eb62b7d13b9e75f98712db089c9eef1ded8d6fcc7d0094217f2e82e0c335
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 48417E71A00219AFDB54CF58C884BAAB7B8EF84318F16816EEA25D7390E771E941CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1989905191bf49f42eadb9a02807c093ecede48eba88651750ab7d74b4d97855
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 1989905191bf49f42eadb9a02807c093ecede48eba88651750ab7d74b4d97855
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299e4c0913397de1f3665e69ba77cac23d914eedd5d9e3cba2a57aff5f89fa9
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299e4c0913397de1f3665e69ba77cac23d914eedd5d9e3cba2a57aff5f89fa9
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 024FE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024FDF6C: GetCurrentThreadId.KERNEL32 ref: 024FDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,024FA6AC), ref: 024FE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,024FA6AC), ref: 024FE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,024FA6AC), ref: 024FE819

Strings

PromptOnSecureDesktop, xrefs: 024FE840, 024FE845, 024FE87C, 024FE89B

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: a56accd35d16d5296476a644385b9cbdec55a998fa6aa2ab7dce40bd7fb7e2e6
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 4621F9B1A403007AF260B7229C05FEB3E5DDBE5B61F10002FFB09B56E3FA9594508AB5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: b34be97497fedca3b752326b27e86ec13df76e891a8447f3c258caf0ac6daf65
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: b34be97497fedca3b752326b27e86ec13df76e891a8447f3c258caf0ac6daf65
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 024F7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024F76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024F796D
RegCloseKey.ADVAPI32(?), ref: 024F797E

Strings

PromptOnSecureDesktop, xrefs: 024F76C5, 024F76CA, 024F76E5

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: defa90ddeeeb4cb6335233f081d7ad1af239a42402f95ff9d0daaced533014ad
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: F911E130A00109AFEB518FA9DC44FEFBFB9EF85714F140166F610E6290E3B88950CB60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 024F9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024F999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 024F99BD
RegCloseKey.ADVAPI32(?), ref: 024F99C6

Strings

PromptOnSecureDesktop, xrefs: 024F9989, 024F998E, 024F99B0, 024F99D3

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 1a598632ca9520a7501d695372c055da7abd4799205f8b4da879f70108cbcb94
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: A8F0F6B2680208BFF7106B51EC06FDB3A2CDB94B10F100065FB05B51D1F6E59A908AB9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 1de8ff1520225209df033a468c4c448d63514a3a5e91d9bb697f39b21080aa95
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 1de8ff1520225209df033a468c4c448d63514a3a5e91d9bb697f39b21080aa95
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 024F28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 024F28FA
gethostbyname.WS2_32(u6A), ref: 024F2906

Strings

time_cfg, xrefs: 024F28EB
u6A, xrefs: 024F28EC, 024F28F9, 024F2905

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 04a30915f72c89a7130f78be1c237eb8441b54fff2797699d3e31540da7430e3
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 97E0C2306041118FCB80CB2CF848AC637E4EF8A230F008282F940D32A0C7B4DCC09740

Function 024F69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 024F69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 024F6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 024F6A3A
CloseHandle.KERNEL32(000000FF), ref: 024F6BD8

Part of subcall function 024FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024F1DCF,?), ref: 024FEEA8
Part of subcall function 024FEE95: HeapFree.KERNEL32(00000000), ref: 024FEEAF

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 938147c7c0cc6e4ac267dfe4d3b18324f6311335e6d7007dcd3517a4f118d760
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 9F712971D0022DEFDF11DFA4CD80AEEBBB9FB44314F11456AE625A6290D7309E92CB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 024F417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024F41AB
GetLastError.KERNEL32 ref: 024F41B5
WaitForSingleObject.KERNEL32(?,?), ref: 024F41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024F41D9

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: e25839bc1c0ccd4d78a83f97f8c62893c935e49a87f215d732c3eda93b177f8d
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B701E97651110EABDF02DF90EE88BEF7B6CEB18255F004062FA01E2150DB70AB548BB5

Function 024F41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024F421F
GetLastError.KERNEL32 ref: 024F4229
WaitForSingleObject.KERNEL32(?,?), ref: 024F423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024F424D

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: f81c76ef026897eaab91a6c462a0c3af0e84f051b9661b6027abee0e54737243
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 1A010872511109AFDF41DF90ED84BEF7BACEB48295F018062FA01E6150DB70DA548BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 024FE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 024FE066

Strings

A, xrefs: 024FE07F
A, xrefs: 024FE037, 024FE03C
A, xrefs: 024FE036

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 5e63c1852aae49fa7618872449b59412900e7ec915620f9e5e5c56066fc0d285
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 04F062313007229FCB60CF25D884A83B7E9FB85326B54872BE654C3A70D374A499CF55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 024FE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,024F44E2,00000000,00000000,00000000), ref: 024FE470
CloseHandle.KERNEL32(00000001,00000003), ref: 024FE484

Part of subcall function 024FE2FC: RegCreateKeyExA.ADVAPI32(80000001,024FE50A,00000000,00000000,00000000,00020106,00000000,024FE50A,00000000,000000E4), ref: 024FE319
Part of subcall function 024FE2FC: RegSetValueExA.ADVAPI32(024FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024FE38E
Part of subcall function 024FE2FC: RegDeleteValueA.ADVAPI32(024FE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024FE3BF
Part of subcall function 024FE2FC: RegCloseKey.ADVAPI32(024FE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,024FE50A), ref: 024FE3C8

Strings

PromptOnSecureDesktop, xrefs: 024FE4F1, 024FE4F6, 024FE537, 024FE561

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 12f92d1e6ffa49b3f22b36c3ec4cf179d717c8d76239e420104044f3e4bdf30a
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: E941DA71E00208BAEB60AF928C45FDB3B6CDB84725F14802BFF09941B1E7B58650DEB5

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: c045c498aada669352df22a1777108d7d540d58746e4c3ccf69df76ec8d8be56
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: c045c498aada669352df22a1777108d7d540d58746e4c3ccf69df76ec8d8be56
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 024F8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 024F83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 024F8477

Part of subcall function 024F69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 024F69E5
Part of subcall function 024F69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 024F6A26
Part of subcall function 024F69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 024F6A3A

Part of subcall function 024FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024F1DCF,?), ref: 024FEEA8
Part of subcall function 024FEE95: HeapFree.KERNEL32(00000000), ref: 024FEEAF

Strings

PromptOnSecureDesktop, xrefs: 024F83B2, 024F83B7, 024F8483

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 57e0a585f8af466b2f18bf718e8c77468ceb7bd7ee470d275e9e35f15bae483d
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: FD4181B2900109BFEB50EBA19E80EFF777DEB84304F0444ABE704DA150F7B05A988B60

Function 024FE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,024FE859,00000000,00020119,024FE859,PromptOnSecureDesktop), ref: 024FE64D
RegCloseKey.ADVAPI32(024FE859,?,?,?,?,000000C8,000000E4), ref: 024FE787

Strings

PromptOnSecureDesktop, xrefs: 024FE637

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: cf0fb49311caa2fb2f9fc466635ac6bebc3864c9587d0ef4ade94ddb3ec17880
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 0F4108B2E0011DBFDF51EF95DC80EEEBBB9FB44705F144466EA00A6260E3719A558B60

Function 024FAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024FAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 024FB00D

Part of subcall function 024FAF6F: gethostname.WS2_32(?,00000080), ref: 024FAF83
Part of subcall function 024FAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 024FAFE6

Part of subcall function 024F331C: gethostname.WS2_32(?,00000080), ref: 024F333F
Part of subcall function 024F331C: gethostbyname.WS2_32(?), ref: 024F3349

Part of subcall function 024FAA0A: inet_ntoa.WS2_32(00000000), ref: 024FAA10

Strings

%OUTLOOK_BND_, xrefs: 024FB076, 024FB07B, 024FB0BE, 024FB0DD

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: 6c67656ecfee36a0685cebd46c3c3f7ec0befaaf91a2ae693f1d92d93231ff67
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 3E41607290020CAFDB61EFA1DC45EEE3B6DFF48304F14442BFA2592151EA75EA448F54

Function 024F9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 024F9536
Sleep.KERNEL32(000001F4), ref: 024F955D

Strings

, xrefs: 024F94D9

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 3d3aaffe0af8942e09e337ea3c7125b716f914edf360eda09c4142e6ef97bae7
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 1D412972C083997FEBB68B68D89C7A73FA49BC2318F1410A7D682572A2D7744981C711

Function 024FBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024FB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 024FBA3A
InterlockedIncrement.KERNEL32(?), ref: 024FBA94
GetTickCount.KERNEL32 ref: 024FBB79
GetTickCount.KERNEL32 ref: 024FBB99
InterlockedIncrement.KERNEL32(?), ref: 024FBE15
closesocket.WS2_32(00000000), ref: 024FBEB4

Strings

%FROM_EMAIL, xrefs: 024FBC7D

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: bd667fb0036900d3adb318375d01ecf2c7cb3a80b1f8e5fe3323589bf978ea6f
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 28317C71500248DFDFA5DFA5DC84AEAB7A9EB89704F20405BFB2482160EB30DA85CF10

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 024F709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 024F70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 024F70F4

Strings

|, xrefs: 024F70E6

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: ab2670516983cca0ee6db256ebadc1ce2e6803e9dc6c1fd48acecf2f3763383d
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: C0112A72900118EBDB52CFD4DD84ADFB7BCEB44305F1441A6E701E6294D7749B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 024F3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024F2F88: GetModuleHandleA.KERNEL32(?), ref: 024F2FA1
Part of subcall function 024F2F88: LoadLibraryA.KERNEL32(?), ref: 024F2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 024F31DA
HeapFree.KERNEL32(00000000), ref: 024F31E1

Memory Dump Source

Source File: 00000000.00000002.1729171186.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 8147e6e128b689361e744be1c35b16ef96e8b44771509174dceaa996af349663
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: AE51BE3190028AEFCB41DF64D884AFABB75FF45304F1541AAED96D7210E732DA19CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1727845808.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1727845808.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dIg0MWRViP.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: rdliobhf.exePID: 7372, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1564
Total number of Limit Nodes:	32

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\dIg0MWRViP.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
soirllif, xrefs: 0040A389, 0040A397
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 0040A1D9
", xrefs: 0040A078
", xrefs: 0040A189
P, xrefs: 00409DAA
", xrefs: 00409EDB
C:\Users\user\Desktop\dIg0MWRViP.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\dIg0MWRViP.exe$C:\Windows\SysWOW64\soirllif\rdliobhf.exe$D$P$\$soirllif
API String ID: 2089075347-2557760764
Opcode ID: 117ca98af2dac046968fa157663bb78c5b3ef41bfb034ede8011e49c8b204cf1
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 117ca98af2dac046968fa157663bb78c5b3ef41bfb034ede8011e49c8b204cf1
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
@, xrefs: 00401380
, xrefs: 00401462
uac, xrefs: 00401628
useless, xrefs: 0040161E
D, xrefs: 004015C6
<, xrefs: 00401378
PDu, xrefs: 0040139A
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: d1745f93e4738621f3a81734226608b64e23a07a53a3347429d52bf37170d4a4
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: d1745f93e4738621f3a81734226608b64e23a07a53a3347429d52bf37170d4a4
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 024C003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024C024D

Strings

cess, xrefs: 024C018D
kernel32.dll, xrefs: 024C008F, 024C0095

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fc6d8bf3b30f58ecec1e8ce670d687e404b49ad6cec5627aabf533009412aab4
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 0D526C74A01229DFDBA4CF58C984BADBBB1BF09304F1480DAE54DAB351DB30AA95CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: db8e7b4b42e65af80add877bb874c42dec97f5f82b139a1a33863129b24a212d
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: db8e7b4b42e65af80add877bb874c42dec97f5f82b139a1a33863129b24a212d
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 026F94C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 026F94EE
Module32First.KERNEL32(00000000,00000224), ref: 026F950E

Memory Dump Source

Source File: 0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 026F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26f8000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e46097eaea17a340783bf3680106f53e8f8d1ff6836240b338b794557d10e0b4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9BF096316017117FDB707BF5988CB6E76E8FF89729F100628E746911C0DB70E8458A61

Function 024C0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024C0223,?,?), ref: 024C0E19
SetErrorMode.KERNELBASE(00000000,?,?,024C0223,?,?), ref: 024C0E1E

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 19e3bb3d86d1ccb7e2d50aa8a73f4fa727658f1bcbf078656ba80fd3e822a18e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 82D01235145128B7D7403A94DC09BDE7B1CDF05B66F108011FB0DD9180C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 026F9185 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026F91D6

Memory Dump Source

Source File: 0000000B.00000002.1728761636.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 026F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26f8000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c260efb2edc5711c597ba91e96d0c548169184bc8d6bf2053b117bf8376c107d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7E113C79A00208EFDB01DF98C985E98BBF5AF08350F158094FA489B361D771EA90DF94

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 395b739cd88b4435df89baafb553413b39c59aeb185fe489df637a3592f54fe2
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 395b739cd88b4435df89baafb553413b39c59aeb185fe489df637a3592f54fe2
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 024C65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 024C65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024C6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 024C6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 024C6652

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 82c0fc38d93388e4804103bf336a3c17f6e41e9c0ad214ac57441598846cd90b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 6111A775700218BFDB515F69DC05F9B3FACEB44BA9F21802AFA04E7250D7B1DD008AA4

Function 024C9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 024C9E6D
lstrcpy.KERNEL32(?,00000000), ref: 024C9FE1
lstrcat.KERNEL32(?,?), ref: 024C9FF2
lstrcat.KERNEL32(?,0041070C), ref: 024CA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 024CA054
DeleteFileA.KERNEL32(?), ref: 024CA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 024CA0D6
lstrcpy.KERNEL32 ref: 024CA12F
lstrlen.KERNEL32(00000022), ref: 024CA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 024C9F13

Part of subcall function 024C7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 024C7081

Part of subcall function 024C6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eaudxxur,024C7043), ref: 024C6F4E
Part of subcall function 024C6F30: GetProcAddress.KERNEL32(00000000), ref: 024C6F55
Part of subcall function 024C6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024C6F7B
Part of subcall function 024C6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024C6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 024CA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024CA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 024CA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 024CA21B
GetDriveTypeA.KERNEL32(?), ref: 024CA265
lstrcat.KERNEL32(?,00000000), ref: 024CA29F
lstrcat.KERNEL32(?,00410A34), ref: 024CA2C5
lstrcat.KERNEL32(?,00000022), ref: 024CA2D9
lstrcat.KERNEL32(?,00410A34), ref: 024CA2F4
wsprintfA.USER32 ref: 024CA31D
lstrcat.KERNEL32(?,00000000), ref: 024CA345
lstrcat.KERNEL32(?,?), ref: 024CA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 024CA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 024CA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024CA1D1

Part of subcall function 024C9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024C999D
Part of subcall function 024C9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 024C99BD
Part of subcall function 024C9966: RegCloseKey.ADVAPI32(?), ref: 024C99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 024CA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 024CA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 024CA41D

Strings

D, xrefs: 024CA1F5
\, xrefs: 024C9F73
", xrefs: 024CA142
", xrefs: 024CA2DF
P, xrefs: 024CA011
", xrefs: 024CA3F0

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: fcc6794d4aef2d3c0457f59668b98112263e05b9af3041a2cbd81301b78bb6d8
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 81F150B5C4021DAFDB51DFA58C48EEF7BBDAB08304F2440AFE605E2151E7B58A848F64

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
NtTerminateProcess, xrefs: 004010F6
NtSetInformationThread, xrefs: 00401155
RtlInitUnicodeString, xrefs: 00401135
RtlNtStatusToDosError, xrefs: 00401194
NtFilterToken, xrefs: 0040122B
NtDuplicateToken, xrefs: 004011F3
ntdll.dll, xrefs: 0040100D
NtSetInformationToken, xrefs: 00401175
RtlFreeSid, xrefs: 00401116
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Nov, xrefs: 0040B29C
May, xrefs: 0040B272
Jan, xrefs: 0040B256
Dec, xrefs: 0040B2A3
Mon, xrefs: 0040B22C
Oct, xrefs: 0040B295
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Jul, xrefs: 0040B280
Tue, xrefs: 0040B233
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Mar, xrefs: 0040B264
Sat, xrefs: 0040B24F
Thu, xrefs: 0040B241
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sun, xrefs: 0040B225
Wed, xrefs: 0040B23A

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 024C7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 024C7D21
GetUserNameA.ADVAPI32(?,?), ref: 024C7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024C7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 024C7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024C7DC0
EqualSid.ADVAPI32(?,?), ref: 024C7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 024C7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024C7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024C7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 024C7E12
LocalFree.KERNEL32(00000000), ref: 024C7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024C7E35

Strings

D, xrefs: 024C7D73
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 024C7F49, 024C7F76, 024C7F8A, 024C7F8B

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe$D
API String ID: 2976863881-130915176
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: e565131ad281b0fce6e026ed7c552edbaa419cefb11e0d150b91c1b523d79881
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 5AA16EB6900209AFDB118FA5DC88FEFBBBDFB08344F14816AE505E6250D7758A85CF64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe$D
API String ID: 2976863881-130915176
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b207dd172069646c24aed32b1972735792d3f59ccf14c8b8a18c1bcf80ec5da1
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b207dd172069646c24aed32b1972735792d3f59ccf14c8b8a18c1bcf80ec5da1
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 024C7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024C7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024C7ACD
GetLengthSid.ADVAPI32(?), ref: 024C7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 024C7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024C7B1F
EqualSid.ADVAPI32(?,?), ref: 024C7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 024C7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024C7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024C7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 024C7B77
LocalFree.KERNEL32(00000000), ref: 024C7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024C7B9A
GetAce.ADVAPI32(?,?,?), ref: 024C7BCA
EqualSid.ADVAPI32(?,?), ref: 024C7BF1
DeleteAce.ADVAPI32(?,?), ref: 024C7C0A
EqualSid.ADVAPI32(?,?), ref: 024C7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 024C7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024C7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 024C7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 024C7CE0
LocalFree.KERNEL32(00000000), ref: 024C7CEE

Strings

D, xrefs: 024C7AC3

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: c0a909c33075c437e8cc4432400f6d1f5a6dad3ea33dec7499dc9aeb480b3fc7
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 72815C7590021AAFEB51CFA8DD84FEFBBBCAF08344F14806AE515E6250E7758681CF64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe$localcfg
API String ID: 237177642-2022263889
Opcode ID: b3a58a0bbacdadd0d2a53070e4979eb24f60116d8e755c02499f6ba1b4e33bb5
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: b3a58a0bbacdadd0d2a53070e4979eb24f60116d8e755c02499f6ba1b4e33bb5
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 110b6dfce453f86d90b76d90b4f40e7d8c24a5c0218ad8ac054d44c6fd0a90ba
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 110b6dfce453f86d90b76d90b4f40e7d8c24a5c0218ad8ac054d44c6fd0a90ba
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 024C858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 024C865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 024C867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 024C86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 024C86B1

Strings

", xrefs: 024C896C
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 024C882F, 024C883C, 024C884C

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\soirllif\rdliobhf.exe
API String ID: 237177642-1745462604
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: c0e3202f34e8f96f3da6d04dbd9c849feb8f8f23832266987f88e3c077fdf734
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 63C194B9900108BEEB52ABA9DD84EEF7B7DEB04304F24407FF605E6150E7B04A948F65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: ac048a5111c4c0facacafd4696e747130b11041e76af35315694b4682072b2fe
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: ac048a5111c4c0facacafd4696e747130b11041e76af35315694b4682072b2fe
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 024C14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 024C1601
lstrlenW.KERNEL32(-00000003), ref: 024C17D8

Strings

, xrefs: 024C16C9
D, xrefs: 024C182D
@, xrefs: 024C15E7
<, xrefs: 024C15DF

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: d2c7e484f653707a5a2a36da48215a797199fffbacb1d161265c895f261d76cd
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 97F19EB95083419FD720DF68C888BABB7E5FB88304F10892EF59A97391D774D944CB62

Function 024C7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024C76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 024C7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 024C778F
___ascii_stricmp.LIBCMT ref: 024C78B4
RegCloseKey.ADVAPI32(?), ref: 024C794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024C796D
RegCloseKey.ADVAPI32(?), ref: 024C797E
RegCloseKey.ADVAPI32(?), ref: 024C79AC
RegCloseKey.ADVAPI32(?), ref: 024C7A56

Part of subcall function 024CF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,024C772A,?), ref: 024CF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 024C79F6
RegCloseKey.ADVAPI32(?), ref: 024C7A4D

Strings

", xrefs: 024C7800

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 87216864924191ca78bcb8c5fd105ad370ad8e839b72557d875f693eeb8ac714
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 81C18675900109ABEB519BA9DC44FEFBBBDEF49710F2040AFE504E6150EB759A84CF60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 5af9527d081b75e26a8274f62d41663e3dd5d5ca7bdbbab9435bf0acb249f6fa
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 5af9527d081b75e26a8274f62d41663e3dd5d5ca7bdbbab9435bf0acb249f6fa
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 024C2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 024C2CED
socket.WS2_32(00000002,00000002,00000011), ref: 024C2D07
htons.WS2_32(00000000), ref: 024C2D42
select.WS2_32 ref: 024C2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 024C2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024C2E62

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 51601fd507e2cb21e389be1b252138d2247278f1e2ba16c986ec0b9394c4cab3
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 5F61E0B9504309ABC360DF69CC08B6BBBE8FB48745F20481EFD85A6250D7F4D8808BA5

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_HST, xrefs: 0040AEC5
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 7bbacfd63cc1bd3358eb6f9f25528e70d4a402c133def0f16d35053a1172090f
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 7bbacfd63cc1bd3358eb6f9f25528e70d4a402c133def0f16d35053a1172090f
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 02aec6f577dd688fddbb5344b15a6666d7f538056132fce720943a2534271e66
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: 02aec6f577dd688fddbb5344b15a6666d7f538056132fce720943a2534271e66
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: f6bf990b8d2e0653f7ce57bc0c35302b71962c3564253f9b7ed5e4bc4b128e8d
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: f6bf990b8d2e0653f7ce57bc0c35302b71962c3564253f9b7ed5e4bc4b128e8d
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: db7f5c645f4a165619cd73390d37071b2a25bff7da9d907bf9deffaa756c70e2
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: db7f5c645f4a165619cd73390d37071b2a25bff7da9d907bf9deffaa756c70e2
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 024C3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 024C3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 024C3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 024C3095
RtlAllocateHeap.NTDLL(00000000), ref: 024C30B6
htons.WS2_32(00000035), ref: 024C30EF
inet_addr.WS2_32(?), ref: 024C30FA
gethostbyname.WS2_32(?), ref: 024C310D
HeapFree.KERNEL32(00000000), ref: 024C314D

Strings

iphlpapi.dll, xrefs: 024C3062, 024C3067, 024C3077

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: c9e7219f461c17bc91a7ca47c60f41a9c6e930427c0e366cc9640271a7091e6e
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 5531A635A00206AFDB529FBD9C44AAF7B78AF04364F2481AAE514E3390DB74D5418B54

Function 024C958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 024C95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024C95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 024C95DC
wsprintfA.USER32 ref: 024C9635
wsprintfA.USER32 ref: 024C9673
wsprintfA.USER32 ref: 024C96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 024C9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024C978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024C97D8

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 9b9c6adee644aa5beef5b6ad230c3a6036b6ea385d322a29a422c7f29ed699bd
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: D6A17FB6900648FBEB61DFA5CC44FEA3BADEB04740F20402BFA1592251E7B5D584CFA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: 0cf6a8701cb8f0680dc0f016b74236af14a98fd9df1df95cbda4f4d63be35472
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: 0cf6a8701cb8f0680dc0f016b74236af14a98fd9df1df95cbda4f4d63be35472
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: c846f043494d1212c12cca3077d5224032b1241b6052029cc8ab7cf3cda5ab79
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: c846f043494d1212c12cca3077d5224032b1241b6052029cc8ab7cf3cda5ab79
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 024C6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 024C67C3
htonl.WS2_32(?), ref: 024C67DF
htonl.WS2_32(?), ref: 024C67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 024C68F1
ExitProcess.KERNEL32 ref: 024C69BC

Strings

localcfg, xrefs: 024C6994
except_info, xrefs: 024C698F

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 3fbd85c19b10e84d9b20b97050484039dbb883e9c5ac34b7cb0ccb643d30dd86
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: E1616E71A40208AFDB609FA4DC45FEA77E9FB48300F24806AFA69D2161EB759990CF14

Function 024CF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(024CCC84), ref: 024CF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 024CF5CE
closesocket.WS2_32(00000000), ref: 024CF5DC

Strings

time_cfg, xrefs: 024CF58A

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: b297404e5203bb6c7866c785525ba01d071044cef829b04a48b1df60fcb65e04
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: B5317E75900118ABDB10DFA9DC84DEF7BBDEF48710F21456BF905D3150E7748A868BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 024C2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 024C2FA1
LoadLibraryA.KERNEL32(?), ref: 024C2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 024C2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024C3000
RtlAllocateHeap.NTDLL(00000000), ref: 024C3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 024C3032

Strings

dnsapi.dll, xrefs: 024C2F90

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 971f6ca0edf503d8d597d255655b6f86adf1307d305477bf3859b572258999d0
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 98219575D00619BBCB619F59DC44AAFBFB8EF08B10F108466F901E7240D7B49AC18BD4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 95e7c86f2c9233c41f1e2c53a6d570cd49a4b83f91fe69b21a1c821a086f9375
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 95e7c86f2c9233c41f1e2c53a6d570cd49a4b83f91fe69b21a1c821a086f9375
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 024C99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 024C9A18
GetThreadContext.KERNEL32(?,?), ref: 024C9A52
TerminateProcess.KERNEL32(?,00000000), ref: 024C9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 024C9A98
SetThreadContext.KERNEL32(?,00010002), ref: 024C9AB5
ResumeThread.KERNEL32(?), ref: 024C9AC2

Strings

D, xrefs: 024C9A10

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 2a3bbc279247ab36c163c3a4e0d898bcfc8dbc4305b3a43ba3b638394212f899
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 4C216BB1A01219BBDB519BA5DC08EEF7BBCEF04750F104066FA09E1150E7768A84CBA4

Function 024C1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 024C1C18
LoadLibraryA.KERNEL32(004102C8), ref: 024C1C26
GetProcessHeap.KERNEL32 ref: 024C1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 024C1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 024C1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 024C1D02
FreeLibrary.KERNEL32(?), ref: 024C1D0B

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 49c7c799b6bcd6405fbfb43a39ffc21f69cba4d8fe11d6cbe7bdeb279289f4fe
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: AE315E3AD00209BFCB519FA8DC888FFBAB9EB45315B34447EF509A2211D7B55E80DB94

Function 024C6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 024C6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 024C6D22
GetLastError.KERNEL32 ref: 024C6DA7
CloseHandle.KERNEL32(?), ref: 024C6DB5
GetLastError.KERNEL32 ref: 024C6DD6
DeleteFileA.KERNEL32(?), ref: 024C6DE7
GetLastError.KERNEL32 ref: 024C6DFD

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 545bc9d92ca86cb37e1ae88ba857e345ee992d6c0e796fb472f7f0c4b09ae3b5
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 9E31D37A900149BFCB41DFA99D44ADF7F7DEF88310F25C06AE251E3250D77085958BA1

Function 024C6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eaudxxur,024C7043), ref: 024C6F4E
GetProcAddress.KERNEL32(00000000), ref: 024C6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024C6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024C6F92

Strings

C:\Windows\SysWOW64\, xrefs: 024C6F30, 024C6F38, 024C6F65, 024C6F6C, 024C6F7A, 024C6F85, 024C6F91, 024C6FA9, 024C6FC6, 024C6FEC
\\.\pipe\eaudxxur, xrefs: 024C6F37

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\eaudxxur
API String ID: 1082366364-869731139
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 0b770f98c236f249818f236c4fee10615406587190f140a02fd2e158c6f48805
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: A62149297413407AF362533A9C88FF72E4D8B42724F2980AFF504D5680DBD984D68B6D

Function 024CAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 024CAAE5

Strings

localcfg, xrefs: 024CAD72
, xrefs: 024CABB3

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: df207d441994b8c8d5ffab4d510b2d6cf9b8d9f729d3a6122f1d76b035ff7aa6
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: B6712C79A0032C6ADFA18E9CEC85FEF376B9B00719F34442FF904A6190DF6659C88B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 024CE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024CDF6C: GetCurrentThreadId.KERNEL32 ref: 024CDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 024CE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,024C6128), ref: 024CE950
lstrcmp.KERNEL32(?,00000008), ref: 024CE989

Strings

A, xrefs: 024CE8C6, 024CE8CD, 024CE936, 024CE998
A, xrefs: 024CE9A0
A, xrefs: 024CE960, 024CE965

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 745f0a5b2ec287754d7d80993abc519c6f7836beb3e3a9feabf03a7fbc0478e1
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: BA318F39B04705DBDBB98F29C884BA77BE4EB09724F20852FE55687651D370E881CB91

Function 024C6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 024C6E19

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 15e0baeb6dfdbe6c17aa2ab0e2387cc13d9fab2336c369d08a28759bf67de8e8
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: E9214FBA204119BFDB509B69EC48EDF3FADDB892A5B21842BF502D1090EB70DA419674

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 024C92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 024C92E2
wsprintfA.USER32 ref: 024C9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024C9375
lstrlen.KERNEL32(?,?,00000000), ref: 024C9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 024C9394
CloseHandle.KERNEL32(00000000), ref: 024C939B

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 2061c59bc06e3c1b9a2248e9f6ce78faf66c8f357d54c1ca788f40c281093127
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: D61175B57401147BE7606776DC0DFEF3A6EDBC8B10F10806EBB06A5090EBB44A458B64

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 730725e1a30653b3eba158ee6b5a706d92185f15afc7f0cb0d565943f0052150
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: 730725e1a30653b3eba158ee6b5a706d92185f15afc7f0cb0d565943f0052150
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 024CC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024CC6B4
InterlockedIncrement.KERNEL32(024CC74B), ref: 024CC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,024CC747), ref: 024CC728
CloseHandle.KERNEL32(00000000,?,024CC747,00413588,024C8A77), ref: 024CC733

Strings

localcfg, xrefs: 024CC544

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: ebc9490d64dadb325e249800689ef0af3f61f6ab7ac696e29697050461882820
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: C7515DB5A01B418FD7A49F2DC6C462ABBE9FB48704B60593FE18BC7A90D774E841CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe
API String ID: 124786226-812669611
Opcode ID: e4e0719a5a2cd3b34ec34ac27a8a6d66355905f4f1668ca4ed4b8e52890c3985
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: e4e0719a5a2cd3b34ec34ac27a8a6d66355905f4f1668ca4ed4b8e52890c3985
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 024C71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024C71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024C7228
LocalFree.KERNEL32(?,?,?), ref: 024C7286
wsprintfA.USER32 ref: 024C729D

Strings

|, xrefs: 024C721A

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 8cff9eb0743a200df35e4fdda0656451c4281af0deaab9389f9a4eab00427b67
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: A0313A76900208BBCB41DFA9DC44BDA7BACEF04314F24C06AF859DB204EB79D6488F94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 024CB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024CB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 024CB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 024CB548
GetTimeZoneInformation.KERNEL32(?), ref: 024CB590
wsprintfA.USER32 ref: 024CB61E

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: a4ae8be21d5c9e4296d0f5758c9c22664e37d094318e6a06190fda991a9ff3f5
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 085110B5D0021CAACF54DFD5D8895EEBBB9FF48308F10816BE505A6150E7B84AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 024C62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 024C6303
LoadLibraryA.KERNEL32(?), ref: 024C632A
GetProcAddress.KERNEL32(00000000,?), ref: 024C63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 024C6405

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 0d21510c1a24db11798edb05d53f6aaee4afafafe174a46740f06eea65cd9bd9
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 1D417C79A00215ABDB54CF58C884BAAB7B8FF84358F26C06EE815D73A0D770E981CB54

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1989905191bf49f42eadb9a02807c093ecede48eba88651750ab7d74b4d97855
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 1989905191bf49f42eadb9a02807c093ecede48eba88651750ab7d74b4d97855
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299e4c0913397de1f3665e69ba77cac23d914eedd5d9e3cba2a57aff5f89fa9
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299e4c0913397de1f3665e69ba77cac23d914eedd5d9e3cba2a57aff5f89fa9
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 024C93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024C93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 024C93CD
CharToOemA.USER32(?,?), ref: 024C93DB
wsprintfA.USER32 ref: 024C9410

Part of subcall function 024C92CB: GetTempPathA.KERNEL32(00000400,?), ref: 024C92E2
Part of subcall function 024C92CB: wsprintfA.USER32 ref: 024C9350
Part of subcall function 024C92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024C9375
Part of subcall function 024C92CB: lstrlen.KERNEL32(?,?,00000000), ref: 024C9389
Part of subcall function 024C92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 024C9394
Part of subcall function 024C92CB: CloseHandle.KERNEL32(00000000), ref: 024C939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 024C9448

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 23e29ef60f02a7512f292373aa27a8d9504dce57ff84618350f48e15ebb6a854
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 230192FA9001187BD760A7619D89EDF377CDB95701F0040A6BB49E2080DAF497C48F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 45fddde66681fcd1d10412195ca3cbb3a67b5acc72870ab1a948a161cfab8417
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 45fddde66681fcd1d10412195ca3cbb3a67b5acc72870ab1a948a161cfab8417
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 024C28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 024C28FA
gethostbyname.WS2_32(u6A), ref: 024C2906

Strings

time_cfg, xrefs: 024C28EB
u6A, xrefs: 024C28EC, 024C28F9, 024C2905

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: b451f6301b751d5a5da28e69ddd764940e01703bb57ffe1d4fb8c2093862792e
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: B3E012346085119FDB90DB2CF848AD677E5EF4A230F15869AF854D72A0C7F4DCC19754

Function 024C69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 024C69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 024C6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 024C6A3A
CloseHandle.KERNEL32(000000FF), ref: 024C6BD8

Part of subcall function 024CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024C1DCF,?), ref: 024CEEA8
Part of subcall function 024CEE95: HeapFree.KERNEL32(00000000), ref: 024CEEAF

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 26d9f7b974645e67f65365f1bcf986a9ec9df0ada89d5788d2489b933229ddad
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: E5712B75D0012DEFDF10DFA8CC80AEEBBB9FB44354F21856AE515A6290E7309E92CB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 024CE2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,024CE50A,00000000,00000000,00000000,00020106,00000000,024CE50A,00000000,000000E4), ref: 024CE319
RegSetValueExA.ADVAPI32(024CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 024CE38E
RegDeleteValueA.ADVAPI32(024CE50A,?,?,?,?,?,000000C8,004122F8), ref: 024CE3BF
RegCloseKey.ADVAPI32(024CE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,024CE50A), ref: 024CE3C8

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: fd89f9398ae9889175827e8a7dbc47c8cdf7058612297866a085b6e83b70eb30
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: D1214F75A0021DABDF609FA9EC85EDF7F79EF08750F108026F904E6160E3B19A54DB90

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 024C417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024C41AB
GetLastError.KERNEL32 ref: 024C41B5
WaitForSingleObject.KERNEL32(?,?), ref: 024C41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024C41D9

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: fb7dfef4bf61873047b235b2e560bb950f4be3fd921a9ee912d425b6516a47d7
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: BD010C7A51110AAFDF02DF94EE88BEF7B6CEB18255F104066F901E2250DB70DB548BB5

Function 024C41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024C421F
GetLastError.KERNEL32 ref: 024C4229
WaitForSingleObject.KERNEL32(?,?), ref: 024C423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024C424D

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: b4541694a99c2459048cc5d7ce67b660234d7d65f4f92cc371c3b7f5c55e752f
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E6014872911109AFDF41DF94EE85BEF3BACEB08295F108066F901E6050D770DA508BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 024CE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 024CE066

Strings

A, xrefs: 024CE037, 024CE03C
A, xrefs: 024CE07F
A, xrefs: 024CE036

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 813d5850a8d50b8b3f8830083f209cae35c12e4f5eabad6b4935b0794e842f28
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: BFF062353007229BCB70CF2AD884A83B7E9FB05335B64862FE554D3260D374A499CF95

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 024C8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 024C83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 024C8477

Part of subcall function 024C69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 024C69E5
Part of subcall function 024C69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 024C6A26
Part of subcall function 024C69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 024C6A3A

Part of subcall function 024CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024C1DCF,?), ref: 024CEEA8
Part of subcall function 024CEE95: HeapFree.KERNEL32(00000000), ref: 024CEEAF

Strings

C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 024C848C, 024C84A1

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe
API String ID: 359188348-812669611
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: ba6fd38386365b4226f09cbcb014cf72ee7aeb61a454cb8e4308ff67cbf119f0
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: E34150B6900109BFEB52EBA99D80EFF776DEB04344F24446FE504D7110FBB45A948B64

Function 024CAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024CAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 024CB00D

Part of subcall function 024CAF6F: gethostname.WS2_32(?,00000080), ref: 024CAF83
Part of subcall function 024CAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 024CAFE6

Part of subcall function 024C331C: gethostname.WS2_32(?,00000080), ref: 024C333F
Part of subcall function 024C331C: gethostbyname.WS2_32(?), ref: 024C3349

Part of subcall function 024CAA0A: inet_ntoa.WS2_32(00000000), ref: 024CAA10

Strings

%OUTLOOK_BND_, xrefs: 024CB076, 024CB07B, 024CB0BE, 024CB0DD

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: e03e2ff82d564fe0a86bbf99675c7463967a1be2b5c49df1e6706bce4e9dd2c5
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 52418E7690020CABDB21EFA5DC45EEE3BADFB08304F24442FFA2592151EA75DA448F54

Function 024C9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 024C9536
Sleep.KERNEL32(000001F4), ref: 024C955D

Strings

, xrefs: 024C94D9

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: f67237d2ae6bddfba3238c34d2b43c4916fb5be22bc9ef89434ba1064c297b3e
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 524107BA9083957EEBB68B6CD88C7B77BA49B02314F3441AFD48297292D7744981C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 024CBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024CB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 024CBA3A
InterlockedIncrement.KERNEL32(?), ref: 024CBA94
GetTickCount.KERNEL32 ref: 024CBB79
GetTickCount.KERNEL32 ref: 024CBB99
InterlockedIncrement.KERNEL32(?), ref: 024CBE15
closesocket.WS2_32(00000000), ref: 024CBEB4

Strings

%FROM_EMAIL, xrefs: 024CBC7D

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 6fadf56ea2e5f365e42bd9a450ed1bf4e602eebe64f8ba02d189b6207ce3f3f3
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 86318BB5400248DFDFA5DFA9DC85AEAB7B9EB48704F20405FFA2492260DB319A85CF10

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 024C709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 024C70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 024C70F4

Strings

|, xrefs: 024C70E6

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 29b86561f2a8b830aa9f6d8db44e16acd656b62b6e3b4964b5c1b22100dbcce1
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 2611FE76900118EBDB52CFD8DC84AEFB7BDAB04715F2441AAE601E6354DB709784CFA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 024C3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024C2F88: GetModuleHandleA.KERNEL32(?), ref: 024C2FA1
Part of subcall function 024C2F88: LoadLibraryA.KERNEL32(?), ref: 024C2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 024C31DA
HeapFree.KERNEL32(00000000), ref: 024C31E1

Memory Dump Source

Source File: 0000000B.00000002.1727896372.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24c0000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 4fdeb9119b8684aa953a8663db27ecb40bef24497a898d2d57f65aebdd51813e
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 6C519179900246AFCF41DF58D8849EA7B75FF05304B2481AEEC5697210E7729A19CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.1726699812.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rdliobhf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 7392, Parent PID: 7372COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02F1C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02F1CA4E
closesocket.WS2_32(?), ref: 02F1CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02F1CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F1CCB4
WriteFile.KERNEL32(02F1A4B3,?,-000000E8,?,00000000), ref: 02F1CCDC
CloseHandle.KERNEL32(02F1A4B3), ref: 02F1CCED
wsprintfA.USER32 ref: 02F1CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02F1CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02F1CD89
CloseHandle.KERNEL32(?), ref: 02F1CD98
CloseHandle.KERNEL32(?), ref: 02F1CD9D
DeleteFileA.KERNEL32(?), ref: 02F1CDC4
CloseHandle.KERNEL32(02F1A4B3), ref: 02F1CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F1CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02F1CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02F1D033
lstrcatA.KERNEL32(?,04700108), ref: 02F1D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02F1D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02F1D171
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000), ref: 02F1D195
CloseHandle.KERNEL32(00000000), ref: 02F1D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02F1D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F1D231
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 02F1D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02F1D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D2C7
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02F1D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F1D372
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 02F1D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02F1D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D408
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02F1D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02F1D45B
CreateProcessA.KERNEL32(?,02F20264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02F1D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F1D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F1D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F1D513
closesocket.WS2_32(?), ref: 02F1D56C
Sleep.KERNEL32(000003E8), ref: 02F1D577
ExitProcess.KERNEL32 ref: 02F1D583
wsprintfA.USER32 ref: 02F1D81F

Part of subcall function 02F1C65C: send.WS2_32(00000000,?,00000000), ref: 02F1C74B

closesocket.WS2_32(?), ref: 02F1DAD5

Strings

drivers\, xrefs: 02F1D067
except_info, xrefs: 02F1D8CD, 02F1D8D2, 02F1D8FB
.sys, xrefs: 02F1D0CC
wtm_r, xrefs: 02F1C97F
wtm_c, xrefs: 02F1C956
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 02F1CC10, 02F1CCF3, 02F1D975, 02F1D98E
.dat, xrefs: 02F1D0D7, 02F1D138, 02F1D1AE, 02F1D1D4, 02F1D28E, 02F1D308, 02F1D3CF, 02F1D441
work_srv, xrefs: 02F1D607, 02F1D60F, 02F1D62C
localcfg, xrefs: 02F1CA89, 02F1CA93, 02F1CAC0, 02F1CAD2, 02F1CE4F, 02F1CE6F, 02F1D8D3, 02F1D8FC
srv_time, xrefs: 02F1CABB
flags_upd, xrefs: 02F1CE4A
\, xrefs: 02F1D39D
lid_file_upd, xrefs: 02F1CE6A
4, xrefs: 02F1D9F7
@, xrefs: 02F1D754
\, xrefs: 02F1D3A7
wtm_w, xrefs: 02F1C96C
time_cfg, xrefs: 02F1C95B, 02F1C962, 02F1C971, 02F1C984
local_time, xrefs: 02F1CACD

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\soirllif\rdliobhf.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-430369839
Opcode ID: 18a386242b3ac90742515fc241293fc6bd02301dee466eabe83a0a9e1ea45731
Instruction ID: f54f20524dbd457271158083a32169bc620463433e97a61d8d4f9457c3649299
Opcode Fuzzy Hash: 18a386242b3ac90742515fc241293fc6bd02301dee466eabe83a0a9e1ea45731
Instruction Fuzzy Hash: 35B2C6B2D80219AFFB20DBA4DC45FEABBBDEB053C4F85045AEB05A6180D7309959CF51

Function 02F19A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02F19A7F
SetErrorMode.KERNELBASE(00000003), ref: 02F19A83
SetUnhandledExceptionFilter.KERNEL32(02F16511), ref: 02F19A8A

Part of subcall function 02F1EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02F1EC5E
Part of subcall function 02F1EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02F1EC72
Part of subcall function 02F1EC54: GetTickCount.KERNEL32 ref: 02F1EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02F19AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02F19ABA
GetCommandLineA.KERNEL32 ref: 02F19AFD
lstrlenA.KERNEL32(?), ref: 02F19B99
ExitProcess.KERNEL32 ref: 02F19C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02F19CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02F19D7A
lstrcatA.KERNEL32(?,?), ref: 02F19D8B
lstrcatA.KERNEL32(?,02F2070C), ref: 02F19D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F19DED
DeleteFileA.KERNEL32(00000022), ref: 02F19E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02F19E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02F19EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02F19ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02F19F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02F19F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02F19F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02F19FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F19FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F19FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02F1A038
lstrcatA.KERNEL32(00000022,02F20A34), ref: 02F1A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02F1A072
lstrcatA.KERNEL32(00000022,02F20A34), ref: 02F1A08D
wsprintfA.USER32 ref: 02F1A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02F1A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02F1A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02F1A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F1A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02F1A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02F1A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02F1A1B6
GetCommandLineA.KERNEL32 ref: 02F1A1E5

Part of subcall function 02F199D2: lstrcpyA.KERNEL32(?,?,00000100,02F222F8,00000000,?,02F19E9D,?,00000022,?,?,?,?,?,?,?), ref: 02F199DF
Part of subcall function 02F199D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02F19E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02F19A3C
Part of subcall function 02F199D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02F19E9D,?,00000022,?,?,?), ref: 02F19A52

lstrlenA.KERNEL32(?), ref: 02F1A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02F1A3B7
GetLastError.KERNEL32 ref: 02F1A3ED
Sleep.KERNELBASE(000003E8), ref: 02F1A400
DeleteFileA.KERNELBASE(02F233D8), ref: 02F1A407
CreateThread.KERNELBASE(00000000,00000000,02F1405E,00000000,00000000,00000000), ref: 02F1A42C
WSAStartup.WS2_32(00001010,?), ref: 02F1A43A
CreateThread.KERNELBASE(00000000,00000000,02F1877E,00000000,00000000,00000000), ref: 02F1A469
Sleep.KERNELBASE(00000BB8), ref: 02F1A48A
GetTickCount.KERNEL32 ref: 02F1A49F
GetTickCount.KERNEL32 ref: 02F1A4B7
Sleep.KERNELBASE(00001A90), ref: 02F1A4C3

Strings

D, xrefs: 02F19F8E
\, xrefs: 02F19D0C
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 02F1A1D9
", xrefs: 02F1A189
%X%08X, xrefs: 02F1A0B0
", xrefs: 02F19EDB
soirllif, xrefs: 02F1A389, 02F1A397
P, xrefs: 02F19DAA
", xrefs: 02F1A078

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\soirllif\rdliobhf.exe$D$P$\$soirllif
API String ID: 2089075347-3576466545
Opcode ID: 730be17f447511e7976acbe5e8d128c6f21e3635856ecb8c2aa4b6319b13cae9
Instruction ID: 54aaf29cbf134defff27741ce710a757fb6bdd3e7e15ae9070588d60ea0cc309
Opcode Fuzzy Hash: 730be17f447511e7976acbe5e8d128c6f21e3635856ecb8c2aa4b6319b13cae9
Instruction Fuzzy Hash: 8752B9B2D4125DAFEB21DBA0CC49EDE77BCAF05384F8444A9E709E2140DB719A48CF61

Function 02F1199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02F119B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02F11E9E), ref: 02F119BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02F119E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02F119ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02F119F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02F11E9E), ref: 02F11A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02F11E9E), ref: 02F11A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02F11E9E), ref: 02F11A36
GetAdaptersInfo.IPHLPAPI(00000000,02F11E9E,?,?,?,?,00000001,02F11E9E), ref: 02F11A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02F11E9E,?,?,?,?,00000001,02F11E9E), ref: 02F11A5A
GetAdaptersInfo.IPHLPAPI(00000000,02F11E9E,?,?,?,?,00000001,02F11E9E), ref: 02F11A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02F11E9E), ref: 02F11A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02F11E9E), ref: 02F11AA4

Strings

GetBestInterface, xrefs: 02F119EF
localcfg, xrefs: 02F119A3
GetIfEntry, xrefs: 02F119E4
GetAdaptersInfo, xrefs: 02F119DC
Iphlpapi.dll, xrefs: 02F119B7
123.45.67.89, xrefs: 02F119A6

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 0c4d0e96aabefff26a52b43c449bcaa5db26930ae43b645b3031d0b08738dacf
Instruction ID: db849760bb6e073315f16648cb875b703d45951d3af9758aff6ef4d2f0c06163
Opcode Fuzzy Hash: 0c4d0e96aabefff26a52b43c449bcaa5db26930ae43b645b3031d0b08738dacf
Instruction Fuzzy Hash: F9316F32E40219AFDB219FE4CC888BFBFB9EF56685B55057EE705A2140DB308A44CB60

Function 02F17A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02F17ABA
GetUserNameA.ADVAPI32(?,?), ref: 02F17ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02F2070C,?,?,?), ref: 02F17B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02F17B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02F17B59
EqualSid.ADVAPI32(?,00000022), ref: 02F17B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F17B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F17B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F17B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02F17BAB
LocalFree.KERNEL32(00000000), ref: 02F17BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02F17FC9,?,00000000), ref: 02F17BCE

Strings

D, xrefs: 02F17B0C
C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 02F17CE2, 02F17D0F, 02F17D23, 02F17D24

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe$D
API String ID: 2976863881-130915176
Opcode ID: 973e52edc76a9d0405dcd01c20873d52789aec5f22c09723282a069056a93c31
Instruction ID: 5edb5a36a2f271d29e691e01581333cfa36e330c73872d697961a2cb90304499
Opcode Fuzzy Hash: 973e52edc76a9d0405dcd01c20873d52789aec5f22c09723282a069056a93c31
Instruction Fuzzy Hash: 65A14E72D4021DAFEB21DFA0CC84EEEFB79FB45784F454469E60AE2140DB358A45CB60

Function 02F17809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02F1782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02F17866
GetLengthSid.ADVAPI32(?), ref: 02F17878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02F1789A
GetSecurityDescriptorOwner.ADVAPI32(?,02F17F63,?), ref: 02F178B8
EqualSid.ADVAPI32(?,02F17F63), ref: 02F178D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F178E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F178F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F17901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02F17910
LocalFree.KERNEL32(00000000), ref: 02F17917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02F17933
GetAce.ADVAPI32(?,00000000,?), ref: 02F17963
EqualSid.ADVAPI32(?,02F17F63), ref: 02F1798A
DeleteAce.ADVAPI32(?,00000000), ref: 02F179A3
EqualSid.ADVAPI32(?,02F17F63), ref: 02F179C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F17A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F17A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02F17A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02F17A79
LocalFree.KERNEL32(00000000), ref: 02F17A87

Strings

D, xrefs: 02F1785C

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 577b01b5f8f487479e798cf68531869abe88e325da43a2820410ede62c93f251
Instruction ID: 8394a735326f970c9fb16e86cb2f316b5335f06bc413e10c437138318452f595
Opcode Fuzzy Hash: 577b01b5f8f487479e798cf68531869abe88e325da43a2820410ede62c93f251
Instruction Fuzzy Hash: 77816D72D0011DABDB21DFA1CD44FEEFBB8AF09785F45446AE609E2150DB348649CFA0

Function 02F18328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02F20750,?,?,00000000,localcfg,00000000), ref: 02F183F3
RegQueryValueExA.KERNELBASE(02F20750,?,00000000,?,02F18893,?,?,?,00000000,00000103,02F20750,?,?,00000000,localcfg,00000000), ref: 02F18414
RegSetValueExA.KERNELBASE(02F20750,?,00000000,00000004,02F18893,00000004,?,?,00000000,00000103,02F20750,?,?,00000000,localcfg,00000000), ref: 02F18441
RegCloseKey.ADVAPI32(02F20750,?,?,00000000,00000103,02F20750,?,?,00000000,localcfg,00000000), ref: 02F1844A

Strings

C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 02F185C8, 02F185D5, 02F185E5
localcfg, xrefs: 02F18348

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe$localcfg
API String ID: 237177642-2022263889
Opcode ID: 579ddcd656f2deb09c6f03fe8d8c6135e3329e69f269b6d77b4cc6f1b4583755
Instruction ID: 239dcec225dcf35bb38aad9683846f355a6d927e8829b3fdc8675b3562a33af4
Opcode Fuzzy Hash: 579ddcd656f2deb09c6f03fe8d8c6135e3329e69f269b6d77b4cc6f1b4583755
Instruction Fuzzy Hash: 4DC192B2D8010DBEFB21AB94DD85EEEBB7DEB157C4F540469FB05A2140EB304A588F21

Function 02F11D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02F11DC6
GetSystemInfo.KERNELBASE(?), ref: 02F11DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02F11E03
GetProcAddress.KERNEL32(00000000), ref: 02F11E0A
GetCurrentProcess.KERNEL32(?), ref: 02F11E1B
GetTickCount.KERNEL32 ref: 02F11FC9

Part of subcall function 02F11BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02F11C15

Strings

IsWow64Process, xrefs: 02F11DF2
loader_id, xrefs: 02F11F4B, 02F11F6B
lid_file_upd, xrefs: 02F11E25
work_srv, xrefs: 02F11E5E
localcfg, xrefs: 02F11E2A, 02F11E31, 02F11E44, 02F11E7D, 02F11E8C, 02F11EB2, 02F11ED1, 02F11EE7, 02F11EFF, 02F11F1C, 02F11F34, 02F11F50, 02F11F70
kernel32, xrefs: 02F11DF7
start_srv, xrefs: 02F11E6C
born_date, xrefs: 02F11EAD, 02F11ECC
net_type, xrefs: 02F11E87
flags_upd, xrefs: 02F11E3E, 02F11E43, 02F11E7C
hi_id, xrefs: 02F11F16, 02F11F1B, 02F11F33

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 01d6bb202f41ed2c804328764f2a3cee8cddde10dd598783ec65fa7501197d4a
Instruction ID: ebfe8d785f1dca8a843e60758efd35fc47dc9ade40f78280dae521d9bc3b0f2b
Opcode Fuzzy Hash: 01d6bb202f41ed2c804328764f2a3cee8cddde10dd598783ec65fa7501197d4a
Instruction Fuzzy Hash: 245184B19043486FF330AF658C85F27BAECEB557C8F84091DFB4A82141DB75A908CB65

Function 02F173FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 02F17472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F174F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F17528
___ascii_stricmp.LIBCMT ref: 02F1764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F176E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02F17706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F17717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F17745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F177EF

Part of subcall function 02F1F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02F222F8,000000C8,02F17150,?), ref: 02F1F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F1778F
RegCloseKey.KERNELBASE(?), ref: 02F177E6

Strings

", xrefs: 02F17599

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 22bfe9d8ae4ef31c015e8d1b2b4a2fffed04b3a1e85345b5d18448d2f1ea5a30
Instruction ID: 7be587ebbcb706a6cc390a121a7c9fd1c0ff1dc778001cda7ffedc481daaa333
Opcode Fuzzy Hash: 22bfe9d8ae4ef31c015e8d1b2b4a2fffed04b3a1e85345b5d18448d2f1ea5a30
Instruction Fuzzy Hash: 8DC19472D40219AFEB21EBA4DC44FEEBBB9EF45390F540495E608E6190EB31DA44CF60

Function 02F1675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02F1677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02F1679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02F167B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02F167BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02F167D3
ReadFile.KERNELBASE(000000FF,?,00000040,02F18244,00000000,?,74DF0F10,00000000), ref: 02F16807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F1681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02F1683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F1685C
ReadFile.KERNEL32(000000FF,?,00000028,02F18244,00000000,?,74DF0F10,00000000), ref: 02F1688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 02F16906
ReadFile.KERNEL32(000000FF,?,00000000,02F18244,00000000,?,74DF0F10,00000000), ref: 02F1691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 02F16971

Part of subcall function 02F1EC2E: GetProcessHeap.KERNEL32(00000000,02F1EA27,00000000,02F1EA27,00000000), ref: 02F1EC41
Part of subcall function 02F1EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02F1EC48

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: f78989e0c88b0c2020c359cdffcfbd58957e5fca0b4dfcbc886427e239d93816
Instruction ID: 7621e214a595d63ad044abad5f7d3827e039c03857c97499337a8aafd81dcb1f
Opcode Fuzzy Hash: f78989e0c88b0c2020c359cdffcfbd58957e5fca0b4dfcbc886427e239d93816
Instruction Fuzzy Hash: FC71F472D0021DEFDB158FA4CC80AEEBBB9EF04394F50456AEA15E6190E7309E56DF60

Function 02F1F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02F1CA1D), ref: 02F1F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02F1F367
closesocket.WS2_32(00000000), ref: 02F1F375

Strings

time_cfg, xrefs: 02F1F323

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 49ee634565d722d8181d96c1cc9ac302e06a38e6432a0054e489abd982e73112
Instruction ID: ad4893a8101d15cb8fe89b694db6597343cd93217b67b2bb27c1b66a61e5e6fa
Opcode Fuzzy Hash: 49ee634565d722d8181d96c1cc9ac302e06a38e6432a0054e489abd982e73112
Instruction Fuzzy Hash: 7E316D7294021DABDB109FA5EC859EEBBBCFF49390F50466AFA15D2140E7309A458BA0

Function 02F1405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02F14070
ExitProcess.KERNEL32 ref: 02F14121

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: c6c759a15656fff70e1631fa3047293d3ce70bd45d214be461d06310bf0727fc
Instruction ID: 77d4147e5034a7ef5c770e7a9020b53471550c90313872aaab051ca79e3549dc
Opcode Fuzzy Hash: c6c759a15656fff70e1631fa3047293d3ce70bd45d214be461d06310bf0727fc
Instruction Fuzzy Hash: 6951A3B2D40219BBEB21AAA19C45FFFBB7DEF55794F800065FB10B6080E7318A45CB61

Function 02F12D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02F12F01,?,02F120FF,02F22000), ref: 02F12D3A
LoadLibraryA.KERNEL32(?), ref: 02F12D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02F12D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02F12D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02F12D99
HeapAlloc.KERNEL32(00000000), ref: 02F12DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02F12DCB

Strings

dnsapi.dll, xrefs: 02F12D29
DnsQuery_A, xrefs: 02F12D5B

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: ab557056014b98b7bec9d2b184d38914a0fd142c31af21fa9767252649505df0
Instruction ID: 8dfe6bc8dc20bbb76476588dde53bebb5460efefc8e00c65375ff35e92b102a9
Opcode Fuzzy Hash: ab557056014b98b7bec9d2b184d38914a0fd142c31af21fa9767252649505df0
Instruction Fuzzy Hash: 60216072D4023AABDB219F94DC48AAEBBB8FF19B90F514416FE06E7100D77099859BD0

Function 02F180C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F1815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02F1A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F18187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02F1A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F181BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F18210

Part of subcall function 02F1675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02F1677E
Part of subcall function 02F1675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02F1679A
Part of subcall function 02F1675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02F167B0
Part of subcall function 02F1675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02F167BF
Part of subcall function 02F1675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02F167D3
Part of subcall function 02F1675C: ReadFile.KERNELBASE(000000FF,?,00000040,02F18244,00000000,?,74DF0F10,00000000), ref: 02F16807
Part of subcall function 02F1675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F1681F
Part of subcall function 02F1675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02F1683E
Part of subcall function 02F1675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F1685C

Part of subcall function 02F1EC2E: GetProcessHeap.KERNEL32(00000000,02F1EA27,00000000,02F1EA27,00000000), ref: 02F1EC41
Part of subcall function 02F1EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02F1EC48

Strings

C:\Windows\SysWOW64\soirllif\rdliobhf.exe, xrefs: 02F18225, 02F1823A

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\soirllif\rdliobhf.exe
API String ID: 124786226-812669611
Opcode ID: 724150f9a50eb03cda6a654d491359b9188e3c4adc37452734c588161de5274e
Instruction ID: 15a3b1064726825baef4c718e60f1d56696e23470827de8698a571e2e00de74c
Opcode Fuzzy Hash: 724150f9a50eb03cda6a654d491359b9188e3c4adc37452734c588161de5274e
Instruction Fuzzy Hash: F34181B2D4015DBFFB25EBA09E80DBEB76D9B053C4F94086AEA05E7000EB305A58CB51

Function 02F11AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F11AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F11AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F11B20

Strings

GetAdaptersAddresses, xrefs: 02F11AE3
Iphlpapi.dll, xrefs: 02F11ACC

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: dfffe0f90793c3547895e701162b324574354d3ae876adac0dc0e43af1d9d7a3
Instruction ID: e26eb3a7e92f6b4485f76d3f348fb2abd7212716937e40f8be39b6baa54e09d6
Opcode Fuzzy Hash: dfffe0f90793c3547895e701162b324574354d3ae876adac0dc0e43af1d9d7a3
Instruction Fuzzy Hash: CC11DA72E01138BFDB11DBA9DC848EFFBB9EB44B90B95405AE309A3140E7305A44CB94

Function 02F1E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02F1E5F2,00000000,00020119,02F1E5F2,02F222F8), ref: 02F1E3E6
RegQueryValueExA.ADVAPI32(02F1E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02F1E44E
RegQueryValueExA.ADVAPI32(02F1E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02F1E482
RegQueryValueExA.ADVAPI32(02F1E5F2,?,00000000,?,80000001,?), ref: 02F1E4CF
RegCloseKey.ADVAPI32(02F1E5F2,?,?,?,?,000000C8,000000E4), ref: 02F1E520

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: fc60f9877d7a94746b4064aee561bc59314f3f5e10ff21b5f00cf774d2341194
Instruction ID: 7ae3e197548befaddf3e9587722d7090b2988df92ab0d7cf98dad07acfec910e
Opcode Fuzzy Hash: fc60f9877d7a94746b4064aee561bc59314f3f5e10ff21b5f00cf774d2341194
Instruction Fuzzy Hash: 1B4109B2D0021DAFEF119FD4DC85DEEBBBDEB08384F544566EA11E2150E3319A159F60

Function 02F1F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02F1F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02F1F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02F1F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02F1F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02F1F2FD

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8e1124a05c361682b87cc902e682f877d577585e3cf101a060003f225fbde4cb
Instruction ID: bb347f60b1fc18f746bd9716e1db20b2996a51cb224ecc36a6ba6d66d22c079a
Opcode Fuzzy Hash: 8e1124a05c361682b87cc902e682f877d577585e3cf101a060003f225fbde4cb
Instruction Fuzzy Hash: AA110DB2A40248BAEF11DF94CD41FDE7FBDEB44751F004066BB04EA1D0E6B19A44CB94

Function 02F11BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F11AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F11AD4
Part of subcall function 02F11AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F11AE9
Part of subcall function 02F11AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F11B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02F11C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02F11C51

Strings

localcfg, xrefs: 02F11BE7
hi_id, xrefs: 02F11BE5

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 9c0768e1f53d7943cfc1b9deefaa8326be4f297e10b4fd3ad6ebbead4074cc41
Instruction ID: 526ef537c71bdbfbe3f5027070ba87883bbb9254f384a6ecbe7f36f1d7f06914
Opcode Fuzzy Hash: 9c0768e1f53d7943cfc1b9deefaa8326be4f297e10b4fd3ad6ebbead4074cc41
Instruction Fuzzy Hash: 3F0192B2E0421CBFEB50DAF8C8C49EFBBBCEB54689F500479E706E3540D6309E4496A0

Function 02F11B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02F11AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F11AD4
Part of subcall function 02F11AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F11AE9
Part of subcall function 02F11AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F11B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02F11BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02F11EFD,00000000,00000000,00000000,00000000), ref: 02F11BB8

Strings

localcfg, xrefs: 02F11B7B

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: e2f7ae0dff27d0c50de3f190fb7add49ee5f435c61dcbd92be47c7b755dbd8e4
Instruction ID: 7703717513c280ff6519880837b6c4b19e2a1618cf8d84e799dd41258c6235ba
Opcode Fuzzy Hash: e2f7ae0dff27d0c50de3f190fb7add49ee5f435c61dcbd92be47c7b755dbd8e4
Instruction Fuzzy Hash: 77018BB3E0010CBFEB00DAE9CC809EFFABDAB58694F550462AB01E3140D6705E088AA0

Function 02F12684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02F12693
gethostbyname.WS2_32(00000001), ref: 02F1269F

Strings

time_cfg, xrefs: 02F12684

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: b49cfbf2e8d13b98763e612a8e3a68ab8099c352bf2858a6e7debd0a97fa31d3
Instruction ID: e928a6b2a524ce2411dcce67d97144899f888538487670921f5fe481db59be22
Opcode Fuzzy Hash: b49cfbf2e8d13b98763e612a8e3a68ab8099c352bf2858a6e7debd0a97fa31d3
Instruction Fuzzy Hash: F7E0C231A041218FCB208B28F844BD977E4EF063B0F424585F940C31D0CB30DC808B80

Function 02F1E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02F1DD05: GetTickCount.KERNEL32 ref: 02F1DD0F
Part of subcall function 02F1DD05: InterlockedExchange.KERNEL32(02F236B4,00000001), ref: 02F1DD44
Part of subcall function 02F1DD05: GetCurrentThreadId.KERNEL32 ref: 02F1DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,02F1A445), ref: 02F1E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,02F1A445), ref: 02F1E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,02F1A445), ref: 02F1E5B2

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: bc7d3c23c1059ea87d234b52629c6bbbcad76fc0d0e15a9d40546a832301eee9
Instruction ID: bdc6bd49a80aa689b15fecdeb22d350b649dd7d0c1d4cf93aed64d6d47bbd33d
Opcode Fuzzy Hash: bc7d3c23c1059ea87d234b52629c6bbbcad76fc0d0e15a9d40546a832301eee9
Instruction Fuzzy Hash: F02129B2A803143AF2207A615C45F9B7E5EDB66BD0F800458BF0EB12C3FA55E5148AB1

Function 02F1877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02F188A5

Part of subcall function 02F1F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02F1E342,00000000,75A8EA50,80000001,00000000,02F1E513,?,00000000,00000000,?,000000E4), ref: 02F1F089
Part of subcall function 02F1F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02F1E342,00000000,75A8EA50,80000001,00000000,02F1E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02F1F093

Strings

localcfg, xrefs: 02F187CA, 02F187CF, 02F187FB, 02F18835, 02F18861
rresolv, xrefs: 02F187F6, 02F1885C

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: d3c6d56053055ec81b3b3306c7e0a87c643d13b12752a2889355fe6e2a0cb1f2
Instruction ID: 33da497f2b6e3e4f5b78540027e3f042aa39ecc1a5e946415bc6ac3ecb3dd27a
Opcode Fuzzy Hash: d3c6d56053055ec81b3b3306c7e0a87c643d13b12752a2889355fe6e2a0cb1f2
Instruction Fuzzy Hash: AE21FD32A8C3056AF324F7646D41F6A3BDADB52BE4FD5041DFF04950C0EF91854889A2

Function 02F14000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02F222F8,02F142B6,00000000,00000001,02F222F8,00000000,?,02F198FD), ref: 02F14021
GetLastError.KERNEL32(?,02F198FD,00000001,00000100,02F222F8,02F1A3C7), ref: 02F1402C
Sleep.KERNEL32(000001F4,?,02F198FD,00000001,00000100,02F222F8,02F1A3C7), ref: 02F14046

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 61155e0cc4165c2fd44a2edf5b03c85b00fa31bba1cfb7a63b59ded6a900fc61
Instruction ID: 0dbbd5fe452e1019139a99e10793fe43330878e2e5125030feddad3031179f6a
Opcode Fuzzy Hash: 61155e0cc4165c2fd44a2edf5b03c85b00fa31bba1cfb7a63b59ded6a900fc61
Instruction Fuzzy Hash: A6F0A733A401056BE7354B35AC49B1A7261DBC2FA4F664B28F3B5EA0D0CB3044859F14

Function 02F1DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F1DC19,?,00000104), ref: 02F1DB7F
lstrcpyA.KERNEL32(?,02F228F8), ref: 02F1DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02F1DBC2

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: fae9a860f5626b660e09d1efbb735d2e373781738ffb32a55bb8ade1a02d25de
Instruction ID: 5de81495e31c6321dc8007aa3919990af894774499f63cc617d7b1b3008fae61
Opcode Fuzzy Hash: fae9a860f5626b660e09d1efbb735d2e373781738ffb32a55bb8ade1a02d25de
Instruction Fuzzy Hash: 58F0B47194020DABEF21DF64DC49FD97B69BB10788F504594BB51A40D0DBF2D559CF10

Function 02F1EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02F1EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02F1EC72
GetTickCount.KERNEL32 ref: 02F1EC78

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: d25e58a00651a7f802ea13f20cf07375d5929c129bdc9b8ef1add300ce83902d
Instruction ID: c0a7ba60a7a82a536d753c80476ad5734d64ea6ca90733c704a42a50d8bc5a67
Opcode Fuzzy Hash: d25e58a00651a7f802ea13f20cf07375d5929c129bdc9b8ef1add300ce83902d
Instruction Fuzzy Hash: D0E01AF2C50108BFE710EBB0DC0EE6BB7BCEB09754F410A54B911D6080DA709A188B60

Function 02F130B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02F130D8
gethostbyname.WS2_32(?), ref: 02F130E2

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: bca95df4f816f14c4732dcd8023eb9f7853584754d6baaf6020b15c43d225891
Instruction ID: c80e2370ea83a21380cf1db122c40540d4cc56e0c864471672ad311053aa005f
Opcode Fuzzy Hash: bca95df4f816f14c4732dcd8023eb9f7853584754d6baaf6020b15c43d225891
Instruction Fuzzy Hash: 97E06572D0011D9BCB109BA8EC85F9A77ECBB05248F080465F905E3280EA34E5088790

Function 02F1EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,02F1DB55,7FFF0001), ref: 02F1EC13
RtlReAllocateHeap.NTDLL(00000000,?,02F1DB55,7FFF0001), ref: 02F1EC1A

Part of subcall function 02F1EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02F1EBFE,7FFF0001,?,02F1DB55,7FFF0001), ref: 02F1EBD3
Part of subcall function 02F1EBCC: RtlAllocateHeap.NTDLL(00000000,?,02F1DB55,7FFF0001), ref: 02F1EBDA

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 300f511a32c2ff16a808dafbe839df91cab714c0bd1468b16ed4fd873ffe62df
Instruction ID: c9b858500171f2f6be07ad371b755b3e52cbf533c31d2916e0fcb3fe4510401c
Opcode Fuzzy Hash: 300f511a32c2ff16a808dafbe839df91cab714c0bd1468b16ed4fd873ffe62df
Instruction Fuzzy Hash: 24E01A32544218BADF112A94EC08BA97B9AEB443E2F508015FE0D89460CB3289A0DA94

Function 02F1EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02F1EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02F1EC0A,00000000,80000001,?,02F1DB55,7FFF0001), ref: 02F1EBAD
Part of subcall function 02F1EBA0: HeapSize.KERNEL32(00000000,?,02F1DB55,7FFF0001), ref: 02F1EBB4

GetProcessHeap.KERNEL32(00000000,02F1EA27,00000000,02F1EA27,00000000), ref: 02F1EC41
RtlFreeHeap.NTDLL(00000000), ref: 02F1EC48

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 804a66a183f179e64fe1f6cd064d42f5499d89714ef1416a270200da07a31d4c
Instruction ID: af088bbf5e555c418eaacf098ff14eae1651d7d7a24726c93497cfe2fa0ecde7
Opcode Fuzzy Hash: 804a66a183f179e64fe1f6cd064d42f5499d89714ef1416a270200da07a31d4c
Instruction Fuzzy Hash: ADC01233D462346BD5612650BC1CF9BBB58AF56791F4A080DF905660408B6058458AE1

Function 02F1EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02F1EBFE,7FFF0001,?,02F1DB55,7FFF0001), ref: 02F1EBD3
RtlAllocateHeap.NTDLL(00000000,?,02F1DB55,7FFF0001), ref: 02F1EBDA

Part of subcall function 02F1EB74: GetProcessHeap.KERNEL32(00000000,00000000,02F1EC28,00000000,?,02F1DB55,7FFF0001), ref: 02F1EB81
Part of subcall function 02F1EB74: HeapSize.KERNEL32(00000000,?,02F1DB55,7FFF0001), ref: 02F1EB88

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: e79a6ea3f3134b293f5f6e7eecd403eba074ec0282df52dc26bb6a54c10198ec
Instruction ID: 821d5f5d38f19061799446ac5d9eb4115c705ed493391af5845fe957e02b2e57
Opcode Fuzzy Hash: e79a6ea3f3134b293f5f6e7eecd403eba074ec0282df52dc26bb6a54c10198ec
Instruction Fuzzy Hash: E1C0803394423067D61127A47C0CF9A7E94EF153D2F050408F605C1150CF3448508791

Function 02F1F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02F1CA44), ref: 02F1F476

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a17d6353079739885ffc10fa74f166956a3a7609b3937f136d751e413433daf2
Instruction ID: 93b3d66159dc33e5fb58fe6a4ad162e339df4ae3dc507f297b05c05e743daff0
Opcode Fuzzy Hash: a17d6353079739885ffc10fa74f166956a3a7609b3937f136d751e413433daf2
Instruction Fuzzy Hash: BDF08C3320064AAB9B119E9ADD84CAB3BAEFB892907440222FB04D3110D631E8208BA0

Function 02F11978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02F11992

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 6c1b2773de50ea2cd6639e6f390f76c2a92348f47b09969e9baaf98662e7e8b2
Instruction ID: 023fdaaaa388a756fb0e9410d8f13d0e06c730d1b8f188e3b20b93559598a261
Opcode Fuzzy Hash: 6c1b2773de50ea2cd6639e6f390f76c2a92348f47b09969e9baaf98662e7e8b2
Instruction Fuzzy Hash: D5D022235482356A52102318BC0047FFB8CDF052E2781941FFE48C0040CB30C84187A1

Function 02F1DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02F1DDB5

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: f90d42cca7b89fe3611e5af2dd087c371c4b6f551a9a2966310ed899ea6f8f05
Instruction ID: 390c3e7ca321c8548ba34c89a9b9eabb36fa8c52bc79a4164380b44ffd190608
Opcode Fuzzy Hash: f90d42cca7b89fe3611e5af2dd087c371c4b6f551a9a2966310ed899ea6f8f05
Instruction Fuzzy Hash: 23F08C32A00202CBCB30CE249884656B3F8EB877E9F95483EE756D2140DB30D85ACB11

Non-executed Functions

Function 02F1637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02F19816,EntryPoint), ref: 02F1638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02F19816,EntryPoint), ref: 02F163A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02F163CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02F163EB

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 99f4a405d6f20e42abfc79d1bf43ceff0692376113d1d95ec1b97ed07af4d7e7
Instruction ID: 947a05a2109d8a9f08d29f858819b3cac0cc7f290a3c61ea5553e57fdf4ff32d
Opcode Fuzzy Hash: 99f4a405d6f20e42abfc79d1bf43ceff0692376113d1d95ec1b97ed07af4d7e7
Instruction Fuzzy Hash: 8711A3B2A00219BFEB218F65DC49F9B7BACEB057E4F014464FA04E7280DB71DC108BA0

Function 02F11000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02F11839,02F19646), ref: 02F11012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02F110C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02F110E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02F11101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02F11121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02F11140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02F11160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02F11180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02F1119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02F111BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02F111DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02F111FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02F1121A

Strings

NtSetInformationThread, xrefs: 02F11155
NtFilterToken, xrefs: 02F1122B
RtlSetLastWin32Error, xrefs: 02F110D6
NtTerminateProcess, xrefs: 02F110F6
NtClose, xrefs: 02F111B4
RtlNtStatusToDosError, xrefs: 02F11194
RtlInitUnicodeString, xrefs: 02F11135
RtlAllocateAndInitializeSid, xrefs: 02F1120F
NtSetInformationToken, xrefs: 02F11175
ntdll.dll, xrefs: 02F1100D
NtQueryInformationToken, xrefs: 02F11262
RtlFreeSid, xrefs: 02F11116
RtlExpandEnvironmentStrings_U, xrefs: 02F110BC
RtlLengthSid, xrefs: 02F11246
NtDuplicateToken, xrefs: 02F111F3
NtOpenProcessToken, xrefs: 02F111D4

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 22e7eb3ecf6261811c79ae0db20364e60f3f427e701813493e5ef9b1eb2d8ae4
Instruction ID: 1f5c8d3aa47d51165a9d5532cf97397168ae2968fb99a4f5e96818e60987c2ac
Opcode Fuzzy Hash: 22e7eb3ecf6261811c79ae0db20364e60f3f427e701813493e5ef9b1eb2d8ae4
Instruction Fuzzy Hash: 1D51F5B1E8265997E7308B68A860713B2AA634B6E4F060796DB29F21D0C778C09DCF55

Function 02F1B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 02F1B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 02F1B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02F1B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 02F1B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02F1B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02F1B329
wsprintfA.USER32 ref: 02F1B3B7

Strings

Mar, xrefs: 02F1B264
Thu, xrefs: 02F1B241
Sep, xrefs: 02F1B28E
Dec, xrefs: 02F1B2A3
Apr, xrefs: 02F1B26B
Fri, xrefs: 02F1B248
Jul, xrefs: 02F1B280
Sun, xrefs: 02F1B225
Sat, xrefs: 02F1B24F
Nov, xrefs: 02F1B29C
Feb, xrefs: 02F1B25D
Aug, xrefs: 02F1B287
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02F1B3AF
Jun, xrefs: 02F1B279
Tue, xrefs: 02F1B233
Oct, xrefs: 02F1B295
Wed, xrefs: 02F1B23A
May, xrefs: 02F1B272
Mon, xrefs: 02F1B22C
Jan, xrefs: 02F1B256

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 261658add2fa168816575c4e1aca94a3b54a4160e5b56f4c364013acfc0b4a75
Instruction ID: dac6c43248781d1798e153fcef042cadacce61c5a52a42f39f0a44f389bff5cd
Opcode Fuzzy Hash: 261658add2fa168816575c4e1aca94a3b54a4160e5b56f4c364013acfc0b4a75
Instruction Fuzzy Hash: 3E513AB2E4022CEADF15CFD4D9849EFBBB9AF5A388F10545DE601A6150DB344A9CCB90

Function 02F16511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F1654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02F1655C
htonl.WS2_32(?), ref: 02F16578
htonl.WS2_32(?), ref: 02F16587
wsprintfA.USER32 ref: 02F1659B
wsprintfA.USER32 ref: 02F165DC
wsprintfA.USER32 ref: 02F16671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02F1668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02F16696
wsprintfA.USER32 ref: 02F166B0
wsprintfA.USER32 ref: 02F166E7
wsprintfA.USER32 ref: 02F166FF
wsprintfA.USER32 ref: 02F1671F
ExitProcess.KERNEL32 ref: 02F16755

Strings

except_info, xrefs: 02F16728
12:08:32, xrefs: 02F16535
ver=%d date=%s %sc=%08x a=%p, xrefs: 02F16547
localcfg, xrefs: 02F1672D
Jan 13 2018, xrefs: 02F1653A
plgs:, xrefs: 02F166AA
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02F165D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02F1666B
%d=%p, xrefs: 02F166F9
va=%08X%08X uef=%p, xrefs: 02F16595

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 135338d43c4aa79774e2316fdde08348efdd5a565dca2c011b143452cd29a52f
Instruction ID: 5d5d585cdfbc379afc6d19d3ba75b78ca8df2aba68d0a2a38ef478123ba84563
Opcode Fuzzy Hash: 135338d43c4aa79774e2316fdde08348efdd5a565dca2c011b143452cd29a52f
Instruction Fuzzy Hash: CD619D72A40218AFEB209FB4DC45FEA77E9FF09340F108469FA69D2121EB709944CF10

Function 02F1A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F1A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 02F1A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 02F1A893
wsprintfA.USER32 ref: 02F1A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 02F1A8D2
wsprintfA.USER32 ref: 02F1A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 02F1A97C
wsprintfA.USER32 ref: 02F1A9B9

Strings

Incorrect respons, xrefs: 02F1AB39
., xrefs: 02F1A8CA
localcfg, xrefs: 02F1AB0B
rcpt to:<%s>, xrefs: 02F1A855
AUTH LOGIN, xrefs: 02F1A80C
quit, xrefs: 02F1A86C
ehlo %s, xrefs: 02F1A7F5
ESMTP, xrefs: 02F1AA38
helo %s, xrefs: 02F1A803
Error sending command (sent = %d/%d), xrefs: 02F1A8A7, 02F1A8DA
Too small respons, xrefs: 02F1A9C9
Too big smtp respons (%d bytes), xrefs: 02F1A9B1
data, xrefs: 02F1A85E
mail from:<%s>, xrefs: 02F1A848

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 83122fbc0e304a2ae93175e59011ec4b8d564b20e753facae84544a769d72ff5
Instruction ID: 58ff1c2362602eb52b00db28863a4e3c5375e936bdc505e510f3c7cf22c0736a
Opcode Fuzzy Hash: 83122fbc0e304a2ae93175e59011ec4b8d564b20e753facae84544a769d72ff5
Instruction Fuzzy Hash: 32A16E73E42359ABEF20CA54DC85FAE776AEB113D8F940456FB02A6080DB318548CF51

Function 02F11280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02F1139A
lstrlenW.KERNEL32(-00000003), ref: 02F11571

Strings

@, xrefs: 02F11380
, xrefs: 02F11462
PDu, xrefs: 02F1139A
uac, xrefs: 02F11628
D, xrefs: 02F115C6
<, xrefs: 02F11378
wusa.exe, xrefs: 02F11388
%systemroot%\system32\cmd.exe, xrefs: 02F11316
useless, xrefs: 02F1161E

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 1b94d427176eed7847bf5ec0809b4d77a97724f447e5ec77be61c6a5a1ac8b8c
Instruction ID: 8ead2579c10e9ab7641310cf20dcea616140e5f6d869b1b0e10c045f190c551c
Opcode Fuzzy Hash: 1b94d427176eed7847bf5ec0809b4d77a97724f447e5ec77be61c6a5a1ac8b8c
Instruction Fuzzy Hash: 31F16AB5A083459FD320DF64C888B6BB7E5FB8A384F41491DFB9A97380D7749848CB52

Function 02F12A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 02F12A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 02F12A86
socket.WS2_32(00000002,00000002,00000011), ref: 02F12AA0
htons.WS2_32(00000000), ref: 02F12ADB
select.WS2_32 ref: 02F12B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02F12B4A
htons.WS2_32(?), ref: 02F12B71
htons.WS2_32(?), ref: 02F12B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02F12BFB

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 099e4b2a977d995a86163bcb3909915442e3971e439fb06ae962930b3f217de1
Instruction ID: 4cf1aade1dc650fb9c49c84c73f9fc95765395cfa41fe8d4f75df434f8023c98
Opcode Fuzzy Hash: 099e4b2a977d995a86163bcb3909915442e3971e439fb06ae962930b3f217de1
Instruction Fuzzy Hash: C361C1729043299FD7209FA4DC08B6ABBE8FB997E5F41080DFF4597180DBB0D8548BA1

Function 02F1704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 02F170C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 02F1719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 02F171B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F17208
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F17291
___ascii_stricmp.LIBCMT ref: 02F172C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F172D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F17314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F1738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F173D8

Part of subcall function 02F1F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02F222F8,000000C8,02F17150,?), ref: 02F1F1AD

Strings

", xrefs: 02F17227
, xrefs: 02F17194

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 9f8193f86d71eb8d3d7dae80cc8bffa46513274e1a36c33eb86b12383db08562
Instruction ID: 802be0d6e96dcc02e0bab8e14740ea96f2130e48aa3e573b367315d81ca47208
Opcode Fuzzy Hash: 9f8193f86d71eb8d3d7dae80cc8bffa46513274e1a36c33eb86b12383db08562
Instruction Fuzzy Hash: 1DB19772D44219AEEF15EFA0DC44BEEB7B9EF04380F900469FA05E6090EB719A44CF65

Function 02F1AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02F1AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02F1ADA6

Part of subcall function 02F1AD08: gethostname.WS2_32(?,00000080), ref: 02F1AD1C
Part of subcall function 02F1AD08: lstrlenA.KERNEL32(00000000), ref: 02F1AD60
Part of subcall function 02F1AD08: lstrlenA.KERNEL32(00000000), ref: 02F1AD69
Part of subcall function 02F1AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02F1AD7F

Part of subcall function 02F130B5: gethostname.WS2_32(?,00000080), ref: 02F130D8
Part of subcall function 02F130B5: gethostbyname.WS2_32(?), ref: 02F130E2

wsprintfA.USER32 ref: 02F1AEA5

Part of subcall function 02F1A7A3: inet_ntoa.WS2_32(?), ref: 02F1A7A9

wsprintfA.USER32 ref: 02F1AE4F
wsprintfA.USER32 ref: 02F1AE5E

Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02F1EF92
Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(?), ref: 02F1EF99
Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(00000000), ref: 02F1EFA0

Strings

127.0.0.1, xrefs: 02F1ADEB
%s%d, xrefs: 02F1AE58
%OUTLOOK_MID, xrefs: 02F1AEAE
%OUTLOOK_BND_, xrefs: 02F1AE0F, 02F1AE14, 02F1AE57, 02F1AE76
%OUTLOOK_HST, xrefs: 02F1AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02F1AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02F1AE9F

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 9ccfa89319fccba711677673440dccbb9801d5016e0abcdd65fa51c4fb8bd2ba
Instruction ID: e8756dd0367807bbfd601a0a86bfaa765a4e3f90b40da38be852d4d2f957e462
Opcode Fuzzy Hash: 9ccfa89319fccba711677673440dccbb9801d5016e0abcdd65fa51c4fb8bd2ba
Instruction Fuzzy Hash: 7F411DB290021CABEF25AFA0DC45EEE3BADFB59380F54041AFE1592151EA71D558CF60

Function 02F12DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02F12E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12E4F
htons.WS2_32(00000035), ref: 02F12E88
inet_addr.WS2_32(?), ref: 02F12E93
gethostbyname.WS2_32(?), ref: 02F12EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12EE3
HeapFree.KERNEL32(00000000,?,00000000,02F12F0F,?,02F120FF,02F22000), ref: 02F12EE6

Strings

iphlpapi.dll, xrefs: 02F12DFB, 02F12E00, 02F12E10
GetNetworkParams, xrefs: 02F12E28

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: f716fdc7b4714f8b8efb4c95c5b9e01eb6907b3076ecd8d25099d422a7afafa7
Instruction ID: c5f5f6523d3634978b37769563db1b52ed61c6995bca6786a7dbece50652003a
Opcode Fuzzy Hash: f716fdc7b4714f8b8efb4c95c5b9e01eb6907b3076ecd8d25099d422a7afafa7
Instruction Fuzzy Hash: 7B31E432E4022DABDB209BF89844B6EB778AF167E4F550519EE14E3280DF30C5418B50

Function 02F19326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02F19DD7,?,00000022,?,?,00000000,00000001), ref: 02F19340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02F19DD7,?,00000022,?,?,00000000,00000001), ref: 02F1936E
GetModuleFileNameA.KERNEL32(00000000,?,02F19DD7,?,00000022,?,?,00000000,00000001), ref: 02F19375
wsprintfA.USER32 ref: 02F193CE
wsprintfA.USER32 ref: 02F1940C
wsprintfA.USER32 ref: 02F1948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02F194F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F19526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F19571

Strings

runas, xrefs: 02F19674

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 100dc8fa02cc42f8091e61f66a815ada482e631cb2a9032f60e122c2177d5101
Instruction ID: 470f6c069744e440b952e7c4a0df047206392af84bd89d721d726a097cec32a8
Opcode Fuzzy Hash: 100dc8fa02cc42f8091e61f66a815ada482e631cb2a9032f60e122c2177d5101
Instruction Fuzzy Hash: F3A17CB294025CABFB219FA0CC95FDE7BADEB15780F50042AFB05A2151E7B1D548CFA1

Function 02F12011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F12078
GetTickCount.KERNEL32 ref: 02F120D4
GetTickCount.KERNEL32 ref: 02F120DB
GetTickCount.KERNEL32 ref: 02F1212B
GetTickCount.KERNEL32 ref: 02F12132
GetTickCount.KERNEL32 ref: 02F12142

Part of subcall function 02F1F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02F1E342,00000000,75A8EA50,80000001,00000000,02F1E513,?,00000000,00000000,?,000000E4), ref: 02F1F089
Part of subcall function 02F1F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02F1E342,00000000,75A8EA50,80000001,00000000,02F1E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02F1F093

Part of subcall function 02F1E854: lstrcpyA.KERNEL32(00000001,?,?,02F1D8DF,00000001,localcfg,except_info,00100000,02F20264), ref: 02F1E88B
Part of subcall function 02F1E854: lstrlenA.KERNEL32(00000001,?,02F1D8DF,00000001,localcfg,except_info,00100000,02F20264), ref: 02F1E899

Part of subcall function 02F11C5F: wsprintfA.USER32 ref: 02F11CE1

Strings

qkD, xrefs: 02F120DD, 02F1212D
rbl_ip, xrefs: 02F1218F
localcfg, xrefs: 02F12070, 02F12160, 02F12186, 02F12194, 02F121E4
rbl_bl, xrefs: 02F12181
net_type, xrefs: 02F121DF

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$qkD$rbl_bl$rbl_ip
API String ID: 3976553417-1533126414
Opcode ID: d3a5d2c34c94850c8c596374ce63f59fa0032d1e415f84cd89553082eabf1337
Instruction ID: 7470bcaae4265c9e951d49bfd752b7fe8ebb3991466147968f9435660fc5c114
Opcode Fuzzy Hash: d3a5d2c34c94850c8c596374ce63f59fa0032d1e415f84cd89553082eabf1337
Instruction Fuzzy Hash: 14512031E8430A4EF338EBA4ED44B56BBD5EB12BD4F91091DEF01860D4DBB1A65CCA10

Function 02F1B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F1B467

Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02F1EF92
Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(?), ref: 02F1EF99
Part of subcall function 02F1EF7C: lstrlenA.KERNEL32(00000000), ref: 02F1EFA0

Strings

%M5DATE, xrefs: 02F1B50F
%TO_HASH, xrefs: 02F1B4B0
%FROM_USER, xrefs: 02F1B431
%TO_EMAIL, xrefs: 02F1B473
%TO_USER, xrefs: 02F1B488
%TO_DOMAIN, xrefs: 02F1B44B
%P5DATE, xrefs: 02F1B4F2
%DATE, xrefs: 02F1B4D2
%FROM_DOMAIN, xrefs: 02F1B41E
%FROM_EMAIL, xrefs: 02F1B3E9
%s@%s, xrefs: 02F1B461

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: fc7677822f94d2e5e871c359492de9a9008d63bc01ba25d08bcdc4c077b84737
Instruction ID: 4d02e7c99fbd43b93852ace0b24683f9e0e21786100a7ed6526e9c1490894790
Opcode Fuzzy Hash: fc7677822f94d2e5e871c359492de9a9008d63bc01ba25d08bcdc4c077b84737
Instruction Fuzzy Hash: CA4130B29411297EEF01AAA4CCC1DFF7B6DEE596D8F540019FF05B2100DA71A9298BA1

Function 02F1C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02F1A4C7: GetTickCount.KERNEL32 ref: 02F1A4D1
Part of subcall function 02F1A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02F1A4FA

GetTickCount.KERNEL32 ref: 02F1C31F
GetTickCount.KERNEL32 ref: 02F1C32B
GetTickCount.KERNEL32 ref: 02F1C363
GetTickCount.KERNEL32 ref: 02F1C378
GetTickCount.KERNEL32 ref: 02F1C44D
InterlockedIncrement.KERNEL32(02F1C4E4), ref: 02F1C4AE
CreateThread.KERNEL32(00000000,00000000,02F1B535,00000000,?,02F1C4E0), ref: 02F1C4C1
CloseHandle.KERNEL32(00000000,?,02F1C4E0,02F23588,02F18810), ref: 02F1C4CC

Strings

localcfg, xrefs: 02F1C2DD

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 603437d4119eee8a8d8ddd09fd2dfd67779f42f80888dc81dc31c1fef3d0bf19
Instruction ID: 517df32e829c5fd1bf8e44f2dff6aa819a5779f36af93a970c3a32b8a2b9863b
Opcode Fuzzy Hash: 603437d4119eee8a8d8ddd09fd2dfd67779f42f80888dc81dc31c1fef3d0bf19
Instruction Fuzzy Hash: 94515AB1A40B418FD7248F69C68562AFBE9FB48384B905D3ED28BC7A90D774F844CB15

Function 02F1BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02F1BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02F1BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02F1BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02F1BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02F1BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02F1BF94

Strings

smtp_retr, xrefs: 02F1BE61, 02F1BF8C
smtp_ban, xrefs: 02F1BE55, 02F1BF77
smtp_herr, xrefs: 02F1BE46, 02F1BF62

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 507bf27f286474f5b4286727a2b5cbbccc4fa5088d84922e07a39a5633d5fba8
Instruction ID: de307c63de4cbd20f8849fa8665ea1c22fafc7f16fbdbf4d97a0029904f2b71a
Opcode Fuzzy Hash: 507bf27f286474f5b4286727a2b5cbbccc4fa5088d84922e07a39a5633d5fba8
Instruction Fuzzy Hash: 2B518476E0121AEFDB119BA5C940B5EBBA9AF057CCF844469EF429B210D730E945CF90

Function 02F16A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16A7D
GetDiskFreeSpaceA.KERNEL32(02F19E9D,02F19A60,?,?,?,02F222F8,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02F19A60,?,?,02F19E9D), ref: 02F16B80
GetLastError.KERNEL32(?,?,?,02F19A60,?,?,02F19E9D,?,?,?,?,?,02F19E9D,?,00000022,?), ref: 02F16B96

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 7c813a74a3756b2398380ec4452c409140cedd986203e68d250b8aaf8a4d1ac4
Instruction ID: 9484a1e578c56cab6bdc0c3d60b54c948f725eb229c172a30f98f9b807abeab1
Opcode Fuzzy Hash: 7c813a74a3756b2398380ec4452c409140cedd986203e68d250b8aaf8a4d1ac4
Instruction Fuzzy Hash: B731FDB3D0010DBFEB21EFA09C44E9EBB7DEB59384F45486AE611E3241EB3085588F61

Function 02F16F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02F1D7C3), ref: 02F16F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02F1D7C3), ref: 02F16FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02F16FE8
LocalFree.KERNEL32(00000120), ref: 02F1701F
wsprintfA.USER32 ref: 02F17036

Strings

|, xrefs: 02F16FB3
/%d, xrefs: 02F17030

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: b7156f2bb1b8cedcb580d6b5e4ed510488ff9edb6e95d35b851144bd70bee523
Instruction ID: 17e4d2821bafbd89e92c51443ee13a59e27456a9fd20cce728fa6ccc2d257b77
Opcode Fuzzy Hash: b7156f2bb1b8cedcb580d6b5e4ed510488ff9edb6e95d35b851144bd70bee523
Instruction Fuzzy Hash: 25312B72A00218AFDB11DFA9DC49ADA7BBCEF05394F14815AF919DB100EB35D608CB94

Function 02F16CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02F222F8,000000E4,02F16DDC,000000C8), ref: 02F16CE7
GetProcAddress.KERNEL32(00000000), ref: 02F16CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02F16D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02F16D2B

Strings

C:\Windows\SysWOW64\, xrefs: 02F16CC9, 02F16CD1, 02F16CFE, 02F16D05, 02F16D13, 02F16D1E, 02F16D2A, 02F16D42, 02F16D5F, 02F16D85
kernel32, xrefs: 02F16CE2
GetSystemWow64DirectoryA, xrefs: 02F16CDD

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 653ae286bf26387c91fd4a785678b0d8f99f01ffc9024d8c48ae1cfd136b6ad3
Instruction ID: 19dbc97e3a329054d76e394fdeb5c129908db48524e6e29ef39434a9ef0aabdc
Opcode Fuzzy Hash: 653ae286bf26387c91fd4a785678b0d8f99f01ffc9024d8c48ae1cfd136b6ad3
Instruction Fuzzy Hash: EA215752E816697AF73157324C88F777E4D8B237C4F8E0448FF05E6180CB95864D86B5

Function 02F1977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02F19947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02F222F8), ref: 02F197B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02F222F8), ref: 02F197EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02F222F8), ref: 02F197F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02F222F8), ref: 02F19831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02F222F8), ref: 02F1984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02F222F8), ref: 02F1985B

Strings

D, xrefs: 02F197A9

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 4f06d06bce3bb7968bbdbef1c36c19a06a2c923e07afbdd95eb7f54bff3bad29
Instruction ID: a1d27cfb8002009b8f7264c439257f93811f78f25408a6a93cc77f9da401327b
Opcode Fuzzy Hash: 4f06d06bce3bb7968bbdbef1c36c19a06a2c923e07afbdd95eb7f54bff3bad29
Instruction Fuzzy Hash: 52213D72D4112DBBEB219FA1DC49FEFBB7CEF05694F800464BA19E1040EB709654CBA0

Function 02F1E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F1DD05: GetTickCount.KERNEL32 ref: 02F1DD0F
Part of subcall function 02F1DD05: InterlockedExchange.KERNEL32(02F236B4,00000001), ref: 02F1DD44
Part of subcall function 02F1DD05: GetCurrentThreadId.KERNEL32 ref: 02F1DD53

Part of subcall function 02F1DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02F1DDB5

lstrcpynA.KERNEL32(?,02F11E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02F1EAAA,?,?), ref: 02F1E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02F1EAAA,?,?,00000001,?,02F11E84,?), ref: 02F1E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02F1EAAA,?,?,00000001,?,02F11E84,?,0000000A), ref: 02F1E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02F1EAAA,?,?,00000001,?,02F11E84,?), ref: 02F1E94F

Strings

localcfg, xrefs: 02F1E8AB
flags_upd, xrefs: 02F1E8A7

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: c4a7838bd9c98b0c103b4e6b099313bef0cbb091ab785841bd5484a9fa6278d8
Instruction ID: 9950f5b20183b16be5c15fc1c52218423760be8f79c0def485420432b4b15321
Opcode Fuzzy Hash: c4a7838bd9c98b0c103b4e6b099313bef0cbb091ab785841bd5484a9fa6278d8
Instruction Fuzzy Hash: 5B512D72D0020AAFCB11EFA8CD84DAEBBF9BF48344F55456AE905A7250D735EA148F50

Function 02F16BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02F16BB2

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: b11989f3f4385871897796a03e610b9a4c41cf02bb85cd0c6cbe8600015ebf2c
Instruction ID: e9cd0118ae92863d58611d6a787f2fd3933a35d0ffb8eb28d3e1b77e5b27a8a5
Opcode Fuzzy Hash: b11989f3f4385871897796a03e610b9a4c41cf02bb85cd0c6cbe8600015ebf2c
Instruction Fuzzy Hash: 81219377A04109FFEB259BB0ED48D9FBB6CDB057E5B514819F602E1040EB31DA14DA74

Function 02F19064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02F222F8), ref: 02F1907B
wsprintfA.USER32 ref: 02F190E9
CreateFileA.KERNEL32(02F222F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F1910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02F19122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02F1912D
CloseHandle.KERNEL32(00000000), ref: 02F19134

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 338a72dda9c012752e701c9331db1543a4c25e1850e52af84e27812661c5273d
Instruction ID: eaf06a3b5ed6a2359355a8f8af1a00bf92294a78cc48813a45bce1dcfaba5159
Opcode Fuzzy Hash: 338a72dda9c012752e701c9331db1543a4c25e1850e52af84e27812661c5273d
Instruction Fuzzy Hash: FE119AB3B401187BF7256671DC09FAF766EDBE5B80F418469BB0AA5050EE704A158AA0

Function 02F1DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F1DD0F
GetCurrentThreadId.KERNEL32 ref: 02F1DD20
GetTickCount.KERNEL32 ref: 02F1DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,02F1E538,?,74DF0F10,?,00000000,?,02F1A445), ref: 02F1DD3B
InterlockedExchange.KERNEL32(02F236B4,00000001), ref: 02F1DD44
GetCurrentThreadId.KERNEL32 ref: 02F1DD53

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 207fdb848a4a9c4045b3b959c0f65f15237729af224f09cf65c440a7d3910700
Instruction ID: ecd78ed49f95bac0d7db9bac3a9af64f723557281c44b3f14f7ad0e0e0fb4297
Opcode Fuzzy Hash: 207fdb848a4a9c4045b3b959c0f65f15237729af224f09cf65c440a7d3910700
Instruction Fuzzy Hash: 5EF0B4B3A8410C9BE7609B65A894F25BBBAE767BD1F420859E70AD2140CB24506DCF22

Function 02F1AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02F1AD1C
lstrlenA.KERNEL32(00000000), ref: 02F1AD60
lstrlenA.KERNEL32(00000000), ref: 02F1AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02F1AD7F

Strings

LocalHost, xrefs: 02F1AD79

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 5440c2c45f2eda495027aab5120421731e8e0dad60d5bfdeb7bfdaf5e3e3fbc9
Instruction ID: 180de773e0bffadfd6787d1175a651f32b046870b917d6bb25b7312edfb3e52c
Opcode Fuzzy Hash: 5440c2c45f2eda495027aab5120421731e8e0dad60d5bfdeb7bfdaf5e3e3fbc9
Instruction Fuzzy Hash: F2014921C8698D5DDF3146388844BB47F769BA76CAFC00055E6C28B115EF248047CB51

Function 02F14BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F14BDD
GetTickCount.KERNEL32 ref: 02F14BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,02F15D02,00000000,?,02F1B85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 02F14BF9
InterlockedExchange.KERNEL32(0341B190,00000001), ref: 02F14C02

Strings

%FROM_EMAIL, xrefs: 02F14BD1

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: 737df82da844dcb3fab4fe915cda8cedeace90b3c9cf96df69a439115e55ed6d
Instruction ID: 9ba9968f19ccad0a9713b7e052de3515953241c5c322615023db7217e335d6d6
Opcode Fuzzy Hash: 737df82da844dcb3fab4fe915cda8cedeace90b3c9cf96df69a439115e55ed6d
Instruction Fuzzy Hash: 15E07D3778020C17D72092B55C80F56B35CEBD6BE1F430436F708D3140CE52941041B1

Function 02F14280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02F198FD,00000001,00000100,02F222F8,02F1A3C7), ref: 02F14290
CloseHandle.KERNEL32(02F1A3C7), ref: 02F143AB
CloseHandle.KERNEL32(00000001), ref: 02F143AE

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 587a5a5fcd7b4e121c063c8a7ecdd9c14a555b7f0f72ce75374c1e2a986a34fc
Instruction ID: 906187b9c5b9d287e96204d6ad8a987f6631178995657096070517c6cc9fa788
Opcode Fuzzy Hash: 587a5a5fcd7b4e121c063c8a7ecdd9c14a555b7f0f72ce75374c1e2a986a34fc
Instruction Fuzzy Hash: 37418DB2D00209BBEF20ABA1DD85FAFBFB9EF453A4F504555F614A2180DB348651DBA0

Function 02F16069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02F164CF,00000000), ref: 02F1609C
LoadLibraryA.KERNEL32(?,?,02F164CF,00000000), ref: 02F160C3
GetProcAddress.KERNEL32(?,00000014), ref: 02F1614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02F1619E

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 2da8ff1c8e4bdcd7788be3692e861edd6942da5902f94be94132b245f5f2403a
Instruction ID: 3d32f28b316f04e2c1b93cf4d1f94d9468b9580c439a04cb68c7c292d4e162a5
Opcode Fuzzy Hash: 2da8ff1c8e4bdcd7788be3692e861edd6942da5902f94be94132b245f5f2403a
Instruction Fuzzy Hash: E4417E72E00109EFEB24CF58C884BA9B7BDFF14798F548069EA15E7291DB30E954CB90

Function 02F12923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afaa63190f1469be4966882f6e259bbe02d3f7e50626193a75d71711759f5de7
Instruction ID: e1b6d5479c1d30511b68c963082cb037221814d8d7346f84dc1279cb3bde300c
Opcode Fuzzy Hash: afaa63190f1469be4966882f6e259bbe02d3f7e50626193a75d71711759f5de7
Instruction Fuzzy Hash: AF31A072A00229ABDB209FE9CC81BBEB7F4FF48781F504456EA04E6285E374D641CF50

Function 02F126FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F1272E
htons.WS2_32(00000001), ref: 02F12752
htons.WS2_32(0000000F), ref: 02F127D5
htons.WS2_32(00000001), ref: 02F127E3
sendto.WS2_32(?,02F22BF8,00000009,00000000,00000010,00000010), ref: 02F12802

Part of subcall function 02F1EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02F1EBFE,7FFF0001,?,02F1DB55,7FFF0001), ref: 02F1EBD3
Part of subcall function 02F1EBCC: RtlAllocateHeap.NTDLL(00000000,?,02F1DB55,7FFF0001), ref: 02F1EBDA

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 12b52f4edad1912be686cf550fd1b92b6f317985530b36331e73ff0b016fee41
Instruction ID: 67a49e3a419e4bcec6a8a8f423f1f4ae5f541109d01538380b22273d65aae426
Opcode Fuzzy Hash: 12b52f4edad1912be686cf550fd1b92b6f317985530b36331e73ff0b016fee41
Instruction Fuzzy Hash: 5A317B34A8038E9FDB20CFB4D880A66B760EF1A398BAB445DED558B302D732D456CB00

Function 02F19145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02F222F8), ref: 02F1915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02F19166
CharToOemA.USER32(?,?), ref: 02F19174
wsprintfA.USER32 ref: 02F191A9

Part of subcall function 02F19064: GetTempPathA.KERNEL32(00000400,?,00000000,02F222F8), ref: 02F1907B
Part of subcall function 02F19064: wsprintfA.USER32 ref: 02F190E9
Part of subcall function 02F19064: CreateFileA.KERNEL32(02F222F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F1910E
Part of subcall function 02F19064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02F19122
Part of subcall function 02F19064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02F1912D
Part of subcall function 02F19064: CloseHandle.KERNEL32(00000000), ref: 02F19134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02F191E1

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: cb595a928e1a95adbdefb01dce75a88cf13e6fd873ea427aa8a8829367c9161c
Instruction ID: 624344ab8c06bd3f697275a91366cb21ff31be43efb362015ce1a8350ec9fc56
Opcode Fuzzy Hash: cb595a928e1a95adbdefb01dce75a88cf13e6fd873ea427aa8a8829367c9161c
Instruction Fuzzy Hash: 040184F78401287BE73096618C49FDF7B7CDB96B41F010095BB05E1040DA7096888F70

Function 02F12419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02F12491,?,?,?,02F1E844,-00000030,?,?,?,00000001), ref: 02F12429
lstrlenA.KERNEL32(?,?,02F12491,?,?,?,02F1E844,-00000030,?,?,?,00000001,02F11E3D,00000001,localcfg,lid_file_upd), ref: 02F1243E
lstrcmpiA.KERNEL32(?,?), ref: 02F12452
lstrlenA.KERNEL32(?,?,02F12491,?,?,?,02F1E844,-00000030,?,?,?,00000001,02F11E3D,00000001,localcfg,lid_file_upd), ref: 02F12467

Strings

localcfg, xrefs: 02F1241F

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: c617ac07bebf42aac59da18267b972de755081b11deefd7c765a37efb75783f4
Instruction ID: 17bbd3d633700c190cfab5b1abf888467c45575e181e19e79d6f8e02858b2ec7
Opcode Fuzzy Hash: c617ac07bebf42aac59da18267b972de755081b11deefd7c765a37efb75783f4
Instruction Fuzzy Hash: D501DE32600228EFCF11EFA9DD859DE7BA9EF44394741C425EE5997101E730EE548A94

Function 02F11C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F11CE1
wsprintfA.USER32 ref: 02F11D6B

Strings

localcfg, xrefs: 02F11C70
%u.%u.%u.%u.%s, xrefs: 02F11CDB, 02F11D65

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: b3b47d89d19eb34999b7c98d5a1b4d802b7896c2057e1bd396acea2b416b072a
Instruction ID: 0782ce317af6913c6b84bbca692462ce12d219de911302158d6f5fe4a277a779
Opcode Fuzzy Hash: b3b47d89d19eb34999b7c98d5a1b4d802b7896c2057e1bd396acea2b416b072a
Instruction Fuzzy Hash: 0D419A729042A89FDB21CFB98D44BEE7BE99F49350F240156FEA5D3141D635EA04CFA0

Function 02F1E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F1DD05: GetTickCount.KERNEL32 ref: 02F1DD0F
Part of subcall function 02F1DD05: InterlockedExchange.KERNEL32(02F236B4,00000001), ref: 02F1DD44
Part of subcall function 02F1DD05: GetCurrentThreadId.KERNEL32 ref: 02F1DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,02F15EC1), ref: 02F1E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,02F15EC1), ref: 02F1E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,02F15EC1), ref: 02F1E722

Strings

89ABCDEF, xrefs: 02F1E721

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 3aa99a95b21394723432324fcb6182b129eb2d533887d960c921668ebefb7df2
Instruction ID: 58e4c5d96e9124c119b94c8f3825eaa490ec417bc73df4153d57458e64c9a105
Opcode Fuzzy Hash: 3aa99a95b21394723432324fcb6182b129eb2d533887d960c921668ebefb7df2
Instruction Fuzzy Hash: E131CD32A00319DFDB35CE60D884BA677E4AF067A4F94482AEF5687541D770E884CF80

Function 02F1E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02F1E2A3,00000000,00000000,00000000,00020106,00000000,02F1E2A3,00000000,000000E4), ref: 02F1E0B2
RegSetValueExA.ADVAPI32(02F1E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02F222F8), ref: 02F1E127
RegDeleteValueA.ADVAPI32(02F1E2A3,?,?,?,?,?,000000C8,02F222F8), ref: 02F1E158
RegCloseKey.ADVAPI32(02F1E2A3,?,?,?,?,000000C8,02F222F8,?,?,?,?,?,?,?,?,02F1E2A3), ref: 02F1E161

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 75f94f7bf166afe119abdd1d5a0a34ac357d6a1c76056919eab5b48c8b936f1c
Instruction ID: 3ecb8e37c89ce41e327c661073f82f3c385d9596f6a5093bbe23fc39a3d1d014
Opcode Fuzzy Hash: 75f94f7bf166afe119abdd1d5a0a34ac357d6a1c76056919eab5b48c8b936f1c
Instruction Fuzzy Hash: 5F215E72E4021DBBEF219EA4DC89EDE7F79EF09B90F404061FE05A6150E7318A54DB90

Function 02F13F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02F1A3C7,00000000,00000000,000007D0,00000001), ref: 02F13FB8
GetLastError.KERNEL32 ref: 02F13FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02F13FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F13FE6

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 820e2e31d161a27523068924e82d210b7b2f958b0b43165cc3d44b9cdbeb826f
Instruction ID: 0e30d5c3c504aff96adb3fe1db862ee146d6711401ac9879b1d7367201bfcc83
Opcode Fuzzy Hash: 820e2e31d161a27523068924e82d210b7b2f958b0b43165cc3d44b9cdbeb826f
Instruction Fuzzy Hash: 0E01297391110AABEF15DF90D945BEE7B7CEB04395F404455FA02E2040D730DA288BB1

Function 02F13F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02F1A3C7,00000000,00000000,000007D0,00000001), ref: 02F13F44
GetLastError.KERNEL32 ref: 02F13F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02F13F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F13F72

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: cf2bf50dea530c44dfa85756bf7b77081ab14f357453f4e800cff53b504510c4
Instruction ID: 6f0111a7b6d0ee6d2e5ee934cc607e433e5cd03dee6ca3b94611bc7c2d2b487f
Opcode Fuzzy Hash: cf2bf50dea530c44dfa85756bf7b77081ab14f357453f4e800cff53b504510c4
Instruction Fuzzy Hash: 1601E572911109ABEF15DE91ED84BEF7BBCEF047A5F5044A9FA01E2040D730DA249BB2

Function 02F1A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F1A4D1
GetTickCount.KERNEL32 ref: 02F1A4E4
Sleep.KERNEL32(00000000,?,02F1C2E9,02F1C4E0,00000000,localcfg,?,02F1C4E0,02F23588,02F18810), ref: 02F1A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02F1A4FA

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: c8ca613d4005f7fe99772fad939ecd34a62a6fde2e59f9bed0a333f7ec3ee551
Instruction ID: 4087c37fffff901e3e3d40eee436c0adbb734b1768c503cd5451d6b26fdbba4b
Opcode Fuzzy Hash: c8ca613d4005f7fe99772fad939ecd34a62a6fde2e59f9bed0a333f7ec3ee551
Instruction Fuzzy Hash: B9E0263364220857D61097A5AD84F6AB388AB4ABE1F420425FB04D3240CA1AA855C1B2

Function 02F14E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F14E9E
GetTickCount.KERNEL32 ref: 02F14EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02F14EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02F14EC3

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: cf4b86b7cf52a16493a5753e55675b660f5ee8bd95b841dbff7932e7c0124b51
Instruction ID: ec5b1e53243a5ecb31e2be8fe202cd36e89b8286377933bda84bdd5c5e6112f6
Opcode Fuzzy Hash: cf4b86b7cf52a16493a5753e55675b660f5ee8bd95b841dbff7932e7c0124b51
Instruction Fuzzy Hash: 4CE07D3374020C17E620A3B9AC80F57B7499BD7BF0F020935F709C2140CA57D81242F1

Function 02F130FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F13103
GetTickCount.KERNEL32 ref: 02F1310F
Sleep.KERNEL32(00000000), ref: 02F1311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02F13128

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 8a641fe953535bc7257a6739009533e1eb4b6d28c393b633b8a468d17f93efdc
Instruction ID: f49ffaa5e42c11ae9943b0ba4254d65392cb5c3dd36d0325a9ab98df3dc865f7
Opcode Fuzzy Hash: 8a641fe953535bc7257a6739009533e1eb4b6d28c393b633b8a468d17f93efdc
Instruction Fuzzy Hash: 34E0C233F40219ABFB10AB75AD44B89BA5ADF95BE1F120879F305E6090CA504C188A71

Function 02F18CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F18D02
GetTickCount.KERNEL32 ref: 02F18DA1

Strings

localcfg, xrefs: 02F18D19

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: e2c89a1d795dbaaae382c17ca03d24e233db5706d6a2bc231622375674321d6d
Instruction ID: 99a10a7dda1ea4efc555f36201c47a559a31787e998508288fa8101e5ce7c977
Opcode Fuzzy Hash: e2c89a1d795dbaaae382c17ca03d24e233db5706d6a2bc231622375674321d6d
Instruction Fuzzy Hash: 8C210672E10719AFEB20CFB4DAD065ABBBAFF213D4BA60499D502D7101CB35E944CB50

Function 02F1BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F1BFD0
wsprintfA.USER32 ref: 02F1C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02F1C057

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: ea85cc2d8dc55e3ea388ca793732fdc026862a8da8035e65813b1ebee87ee989
Instruction ID: 8421838e9ff7773a62decf34a5744517d57f712dd354f48100759e5ed290695e
Opcode Fuzzy Hash: ea85cc2d8dc55e3ea388ca793732fdc026862a8da8035e65813b1ebee87ee989
Instruction Fuzzy Hash: 7B11B772100100FFDB529AA9CD44E567FA6FF8C358B34819CF2188E126D633C823EB50

Function 02F138F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02F130FA: GetTickCount.KERNEL32 ref: 02F13103
Part of subcall function 02F130FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02F13128

GetCurrentThreadId.KERNEL32 ref: 02F13929
GetCurrentThreadId.KERNEL32 ref: 02F13939

Strings

%FROM_EMAIL, xrefs: 02F13913

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 69e382f49f0b5dd23cd09fcfc3c5622b3da7171e22ee89978c6fca264d9700d4
Instruction ID: e958ac73ac98d6dedf58afbcc84178b916329081e22a870754e5da13faa56a0f
Opcode Fuzzy Hash: 69e382f49f0b5dd23cd09fcfc3c5622b3da7171e22ee89978c6fca264d9700d4
Instruction Fuzzy Hash: 15114F71940218EFD720DF16D491A5CF3F6FB057A5F91899EEE4597280C770AA84CFA0

Function 02F1AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,02F1BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 02F1ABB9
InterlockedIncrement.KERNEL32(02F23640), ref: 02F1ABE1

Strings

%FROM_EMAIL, xrefs: 02F1AB8C

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: d1a87b0ab57ed096a238b8e2503083f6de44349b1c96518f6f9256286f08faa7
Instruction ID: 296f9125614a5c6fafec0ba03d15a6cbbf0478dc4a9278736598de232d41291d
Opcode Fuzzy Hash: d1a87b0ab57ed096a238b8e2503083f6de44349b1c96518f6f9256286f08faa7
Instruction Fuzzy Hash: 0001B1719093D4AFEB21CF18D881F967FAABF16394F554888F68047203C374E584CBA0

Function 02F126B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02F126C3
inet_ntoa.WS2_32(?), ref: 02F126E4

Strings

localcfg, xrefs: 02F126CD, 02F126D2, 02F126DE

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 183da34ab445efd64267e978c05a24f06964883716d341eb177b48438fbc8472
Instruction ID: b3ae761e550d543df8602d843caab4aa83a8cafc670c83ff66297c9923803b67
Opcode Fuzzy Hash: 183da34ab445efd64267e978c05a24f06964883716d341eb177b48438fbc8472
Instruction Fuzzy Hash: BCF012336482196BEB04AFA4EC05AAA379DDB05690F544466FE08DA0D0EB71D9509B98

Function 02F1EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02F1EB54,_alldiv,02F1F0B7,80000001,00000000,00989680,00000000,?,?,?,02F1E342,00000000,75A8EA50,80000001,00000000), ref: 02F1EAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 02F1EB07

Strings

ntdll.dll, xrefs: 02F1EAED

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 6c87438c7272f0ecc90c3af2e025a012d0203a2629cf60d2f7a48d508a3cadd3
Instruction ID: 21a2597a5d2992a1153f1858f3abf1503dc4e7709791289951d194560488cf69
Opcode Fuzzy Hash: 6c87438c7272f0ecc90c3af2e025a012d0203a2629cf60d2f7a48d508a3cadd3
Instruction Fuzzy Hash: F9D0C775F4030A57AF31CF64950AE05BAECF751FC17814855A507D1501DB35D41CDB04

Function 02F12F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02F12D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02F12F01,?,02F120FF,02F22000), ref: 02F12D3A
Part of subcall function 02F12D21: LoadLibraryA.KERNEL32(?), ref: 02F12D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02F12F73
HeapFree.KERNEL32(00000000), ref: 02F12F7A

Memory Dump Source

Source File: 0000000C.00000002.2944514600.0000000002F10000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 45a62da44e8cc9358703e43fd5a94f66e6f485653edfa5415bdafb4d0de7a826
Instruction ID: 777c78859a99403fc34ec7df68c1b097f9c958538925d8a3d47d5bfdbcee972d
Opcode Fuzzy Hash: 45a62da44e8cc9358703e43fd5a94f66e6f485653edfa5415bdafb4d0de7a826
Instruction Fuzzy Hash: F751B072A0021A9FDF019F64D888AF9B7B5FF05384F5145A9ED96C7210E732DA19CB80

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dIg0MWRViP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\rdliobhf.exe

C:\Windows\SysWOW64\soirllif\rdliobhf.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
dIg0MWRViP.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre