Edit tour

Windows Analysis Report
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Overview

General Information

Sample name:	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Analysis ID:	1445896
MD5:	ea52eb173762deb852109486758797ad
SHA1:	d6326aa179babb5149982c797460347d586988f7
SHA256:	8d2d64d1725161c2aa28dddb6ccb302291badc5a9a96816d0027e5aece23ec4a
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe" MD5: EA52EB173762DEB852109486758797AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.privateemail.com", "Username": "rex@dino-mx.live", "Password": "BTwcMq@2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33523:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33595:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3361f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33823:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe PID: 7044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe PID: 7044	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33523:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33595:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3361f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33823:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 198.54.122.135, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, Initiated: true, ProcessId: 7044, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Avira: detected

Found malware configuration

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.privateemail.com", "Username": "rex@dino-mx.live", "Password": "BTwcMq@2"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Joe Sandbox ML: detected

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 198.54.122.135:587

Source: Joe Sandbox View	IP Address: 198.54.122.135 198.54.122.135
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 198.54.122.135:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.privateemail.com

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.privateemail.com
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.0000000002531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	String found in binary or memory: https://account.dyn.com/
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	String found in binary or memory: https://api.ipify.org
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.0000000002531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.0000000002531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, gmBpn1ecBmQ.cs

.Net Code: siUW49

System Summary

Malicious sample detected (through community Yara rule)

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_0093E280	0_2_0093E280
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_0093A4F8	0_2_0093A4F8
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_0093A960	0_2_0093A960
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00934A98	0_2_00934A98
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00933E80	0_2_00933E80
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_009341BE	0_2_009341BE
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_009341C8	0_2_009341C8
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00931A44	0_2_00931A44
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00931BA1	0_2_00931BA1
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00933E76	0_2_00933E76
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061DA068	0_2_061DA068
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061DBB58	0_2_061DBB58
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E5598	0_2_061E5598
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E65E8	0_2_061E65E8
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061EB230	0_2_061EB230
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E2358	0_2_061E2358
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061EC170	0_2_061EC170
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E7D78	0_2_061E7D78
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E7698	0_2_061E7698
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061EE390	0_2_061EE390
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E0040	0_2_061E0040
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E5CF0	0_2_061E5CF0
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061E0006	0_2_061E0006

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename1953639c-f60b-489d-a7df-596e6ab574dc.exe4 vs 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3242639453.00000000004F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3242906996.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Binary or memory string: OriginalFilename1953639c-f60b-489d-a7df-596e6ab574dc.exe4 vs 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Binary string: ID: 0x{0:X}qSize of the SerializedPropertyStore is less than 8 ({0})/StoreSize: {0} (0x{0X})3\Device\LanmanRedirector\[Failed to retrieve system handle information.>

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Mutant created: NULL

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_00930CCC push edi; retf		0_2_00930C7A
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Code function: 0_2_061DFCBF push es; retf		0_2_061DFCC8

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Memory allocated: 930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Memory allocated: 2530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Memory allocated: 4530000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Window / User API: threadDelayed 1036			Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Window / User API: threadDelayed 4258			Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 1080	Thread sleep count: 1036 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 1080	Thread sleep count: 4258 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98229s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -98009s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe TID: 5404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98577	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98229	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 98009	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245213535.000000000593E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll74

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe PID: 7044, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe PID: 7044, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe PID: 7044, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	141 Virtualization/Sandbox Evasion	1 Input Capture	111 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	100%	Avira	TR/Spy.Gen8
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.privateemail.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.privateemail.com	198.54.122.135	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3245168842.0000000005920000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243071928.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.0000000002531000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.privateemail.com	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe, 00000000.00000002.3243585955.0000000002531000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.54.122.135	mail.privateemail.com	United States		22612	NAMECHEAP-NETUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445896
Start date and time:	2024-05-22 18:13:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 68 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Simulations

Behavior and APIs

Time	Type	Description
12:13:52	API Interceptor	26x Sleep call for process: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.54.122.135	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	Get hash	malicious	AgentTesla	Browse
	rSipari__PO408232023_ZNG__stanbul_pdf.exe	Get hash	malicious	AgentTesla	Browse
	50 adet PO #408232023_Web Sitesi #U00dcr#U00fcnleri_pdf.exe	Get hash	malicious	AgentTesla	Browse
	17158441246d37802f97c2611e248b49702f7346b2788831fc8c7e217b8fb1e2cb7dbf2dad677.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.vbs	Get hash	malicious	AgentTesla	Browse
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse
	17129026260efdd91c6d1ffeca6e8eda3ece36cd849272dce1a2d9ab3c208be65a370d4493880.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	17128389081d4616ae42b2693f5ea6783112f41cb2ee5184f49d983f8bf833df0b0e97b429449.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	BBL ADVICE FOR INWARD_BC I650120-000_04012024.vbs	Get hash	malicious	AgentTesla	Browse
	Kmjcdaceubh.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
172.67.74.152	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.privateemail.com	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	rSipari__PO408232023_ZNG__stanbul_pdf.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	50 adet PO #408232023_Web Sitesi #U00dcr#U00fcnleri_pdf.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	17158441246d37802f97c2611e248b49702f7346b2788831fc8c7e217b8fb1e2cb7dbf2dad677.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.vbs	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	198.54.122.135
	17129026260efdd91c6d1ffeca6e8eda3ece36cd849272dce1a2d9ab3c208be65a370d4493880.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	17128389081d4616ae42b2693f5ea6783112f41cb2ee5184f49d983f8bf833df0b0e97b429449.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	BBL ADVICE FOR INWARD_BC I650120-000_04012024.vbs	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	Kmjcdaceubh.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	198.54.122.135
api.ipify.org	SOA_41457.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	INSTALLATION BOQ KATSINA.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Doc1000050789.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	rSipari__PO408232023_ZNG__stanbul_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MSK203.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	PO N#U00b0202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Offer Required.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Swift_copy.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Wire Transfer Payment Copy #18-05-2024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	EST- 250424-0370pdf.exe	Get hash	malicious	FormBook	Browse	162.0.237.22
	SecuriteInfo.com.Win64.PWSX-gen.16698.32595.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	rSipari__PO408232023_ZNG__stanbul_pdf.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	50 adet PO #408232023_Web Sitesi #U00dcr#U00fcnleri_pdf.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	Okthabah.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.237.22
	taskhost.exe	Get hash	malicious	Xmrig	Browse	162.255.119.99
	http://siddiquimehvish07.github.io/netflix.github.io	Get hash	malicious	Unknown	Browse	162.0.235.241
	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.237.22
	F2qfVHeuUh.exe	Get hash	malicious	FormBook	Browse	63.250.43.147
	https://www.keysurgical.de/Home/SelectLanguage?language=en-US&redirectUrl=https://energreen.rs/.well-known/acme-challenge/	Get hash	malicious	Unknown	Browse	162.0.229.211
CLOUDFLARENETUS	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	172.67.210.170
	https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154fa	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://www.cpcheckme.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	ZXQ3AcEN5Q.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://forfbidrecrossboot.pages.dev/503.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	ZXQ3AcEN5Q.exe	Get hash	malicious	Unknown	Browse	104.21.45.251

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	172.67.74.152
	RFQ-101432620247fl#U00e2#U00aexslx.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SOA_41457.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QUOTATION SHEET_RFQ 564077 2024.5.17.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	INSTALLATION BOQ KATSINA.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGn	Get hash	malicious	Unknown	Browse	172.67.74.152
	New Order.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	New Order.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://twomancake.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	Doc1000050789.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.004495501190702
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
File size:	240'128 bytes
MD5:	ea52eb173762deb852109486758797ad
SHA1:	d6326aa179babb5149982c797460347d586988f7
SHA256:	8d2d64d1725161c2aa28dddb6ccb302291badc5a9a96816d0027e5aece23ec4a
SHA512:	198dce7ae340f4890c6787cd9a97ba4d931b69d031daed80f7bc2019d4c5dae21aaf877dc5bc5c050c5ddf774661ee40584233014487eccff117b70aedae2491
SSDEEP:	3072:VhSmieCmikyXi0bydYt/lrjHVtWV5qeLrgtL:VhSmieCmikyXi0byk9/HVt8rU
TLSH:	60340F037E88EB15D1A83E3782EF6D2413B2B4C71633C60B6F49AF6518516825D7EB2D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Cf............................n.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43bf6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6643A583 [Tue May 14 17:55:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax+00000018h], al
push eax
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
cmp byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bf18	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x546	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x39f74	0x3a000	00a3909bd05f93a3837e78025c08fe80	False	0.3577502020474138	data	5.015918661488969	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x546	0x600	b264bd5e3ffb9db1666f019685939f55	False	0.4029947916666667	data	4.0106295185141425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0xc	0x200	47722ed4378cb86afb4b1954e8c92277	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3c0a0	0x2bc	data			0.44285714285714284
RT_MANIFEST	0x3c35c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:13:50.987557888 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:50.987603903 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:50.987828016 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:50.995300055 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:50.995368004 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:51.490605116 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:51.490866899 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:51.494224072 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:51.494276047 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:51.494713068 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:51.539978981 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:51.582511902 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:52.507375956 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:52.507523060 CEST	443	49704	172.67.74.152	192.168.2.5
May 22, 2024 18:13:52.507879972 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:52.513277054 CEST	49704	443	192.168.2.5	172.67.74.152
May 22, 2024 18:13:52.965719938 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:52.970714092 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:52.970901012 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:53.631640911 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:53.632011890 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:53.637463093 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:53.790719986 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:53.791053057 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:53.796005964 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:53.947731018 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:53.948462963 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:53.953428030 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.107162952 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.109297991 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.109498978 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.114021063 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.118983984 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.118999958 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.119040012 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.132498026 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.132590055 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.156265974 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.187964916 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.347467899 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.351870060 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.357345104 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.514314890 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.515434027 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.535021067 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.690218925 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.718137980 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.723074913 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.881850958 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:54.889238119 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:54.894157887 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.051369905 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.051762104 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.057353020 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.250443935 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.250677109 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.255705118 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.423995018 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.424962997 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.425055981 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.425055981 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.425055981 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:13:55.430039883 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.435869932 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.487266064 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.487274885 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.821208000 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:13:55.868885040 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:15:32.978312969 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:15:32.998413086 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:15:33.152476072 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:15:33.153117895 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:15:33.157126904 CEST	587	49705	198.54.122.135	192.168.2.5
May 22, 2024 18:15:33.157284021 CEST	49705	587	192.168.2.5	198.54.122.135
May 22, 2024 18:15:33.203636885 CEST	587	49705	198.54.122.135	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:13:50.922910929 CEST	58890	53	192.168.2.5	1.1.1.1
May 22, 2024 18:13:50.980293036 CEST	53	58890	1.1.1.1	192.168.2.5
May 22, 2024 18:13:52.956156969 CEST	52936	53	192.168.2.5	1.1.1.1
May 22, 2024 18:13:52.964782953 CEST	53	52936	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 18:13:50.922910929 CEST	192.168.2.5	1.1.1.1	0x86fd	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 22, 2024 18:13:52.956156969 CEST	192.168.2.5	1.1.1.1	0x1080	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 22, 2024 18:13:50.980293036 CEST	1.1.1.1	192.168.2.5	0x86fd	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 22, 2024 18:13:50.980293036 CEST	1.1.1.1	192.168.2.5	0x86fd	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 22, 2024 18:13:50.980293036 CEST	1.1.1.1	192.168.2.5	0x86fd	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 22, 2024 18:13:52.964782953 CEST	1.1.1.1	192.168.2.5	0x1080	No error (0)	mail.privateemail.com	198.54.122.135	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.74.152	443	7044	C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:13:51 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-22 16:13:52 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 16:13:52 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 887e188d7b357d26-EWR
2024-05-22 16:13:52 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 22, 2024 18:13:53.631640911 CEST	587	49705	198.54.122.135	192.168.2.5	220 PrivateEmail.com prod Mail Node
May 22, 2024 18:13:53.632011890 CEST	49705	587	192.168.2.5	198.54.122.135	EHLO 899552
May 22, 2024 18:13:53.790719986 CEST	587	49705	198.54.122.135	192.168.2.5	250-mta-06.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-CHUNKING 250 STARTTLS
May 22, 2024 18:13:53.791053057 CEST	49705	587	192.168.2.5	198.54.122.135	STARTTLS
May 22, 2024 18:13:53.947731018 CEST	587	49705	198.54.122.135	192.168.2.5	220 Ready to start TLS

Analysis Process: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exePID: 7044, Parent PID: 1028

General

Target ID:	0
Start time:	12:13:50
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe"
Imagebase:	0x80000
File size:	240'128 bytes
MD5 hash:	EA52EB173762DEB852109486758797AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.3243585955.00000000025AC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000000.1983017793.0000000000082000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.3243585955.00000000025B4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.3243585955.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exePID: 7044, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	197
Total number of Limit Nodes:	20

Executed Functions

Function 061E2358 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON

Download Yara Rule

Strings

$]q, xrefs: 061E37B0
$]q, xrefs: 061E3780
$]q, xrefs: 061E3763
$]q, xrefs: 061E378C
$]q, xrefs: 061E37A4
$]q, xrefs: 061E3757

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: e890667c278ed8e42c8d968038971793fff20b43a97d586b81aa4f22a52f5b59
Instruction ID: f2f06917fd23c05fad8ac5a5df58a79f760fef07cee937bb1252ccd145b0e2bb
Opcode Fuzzy Hash: e890667c278ed8e42c8d968038971793fff20b43a97d586b81aa4f22a52f5b59
Instruction Fuzzy Hash: 92D26A30E006058FDB64DF68C594A9DB7F6FF89300F5585AAD409AB365EB34ED86CB80

Function 061EB230 Relevance: 8.3, Strings: 6, Instructions: 761COMMON

Download Yara Rule

Strings

$]q, xrefs: 061EBBBD
$]q, xrefs: 061EBBF1
$]q, xrefs: 061EBBFD
$]q, xrefs: 061EBBC9
$]q, xrefs: 061EBB89
$]q, xrefs: 061EBB95

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 00229c60d9e216bc4578eb637725faa479bd5ca27035b714ce3f9d666b89b2d4
Instruction ID: 5e189ce80249b1264848e3e59dec3fbcbe2e617b68e200fe802090a87ddd5245
Opcode Fuzzy Hash: 00229c60d9e216bc4578eb637725faa479bd5ca27035b714ce3f9d666b89b2d4
Instruction Fuzzy Hash: 00528270E046098FDF64CB68D690BAEB7B6EF85310F20882AE409DB355DB35DD46CB91

Function 0093A960 Relevance: 3.1, Instructions: 3103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f7353a393783f54bde8673f7e96563d6b838e707129e892215fc9e74a586ec
Instruction ID: 5bad06fc710090b5918e0c4ab7b1d4b1a6e545fb11cb3fc2792bd5cacbeda0d9
Opcode Fuzzy Hash: 98f7353a393783f54bde8673f7e96563d6b838e707129e892215fc9e74a586ec
Instruction Fuzzy Hash: 0F631A31D10B1A8ACB11EF68C8546A9F7B1FF99300F15D79AE058B7121EB70AAD5CF81

Function 061E7D78 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061E8313
$]q, xrefs: 061E831F

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1f8ae6e04f837a6e363a4e59e486ade23b21292f91eefb2ef4dc9f6fcae1031d
Instruction ID: c1e6abadd473ab0ae867dcaf6402211a04af5b6987a4ec38298eeac33a558517
Opcode Fuzzy Hash: 1f8ae6e04f837a6e363a4e59e486ade23b21292f91eefb2ef4dc9f6fcae1031d
Instruction Fuzzy Hash: 32028C30B006158FDB98DF78D490AAEB7E2EF88300F158929E409DB395DB35ED46CB91

Function 0093E280 Relevance: 2.8, Strings: 2, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 0093E387
$]q, xrefs: 0093E36E

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: Xaq$$]q
API String ID: 0-1280934391
Opcode ID: bd4bd2e6045eaed2c53eab388fe5a7c38201615a61079bd815da094627939c24
Instruction ID: 8d33b4219d89bc8d060b1721be3239156d1c285f73e39238b6196f92e1f0de4a
Opcode Fuzzy Hash: bd4bd2e6045eaed2c53eab388fe5a7c38201615a61079bd815da094627939c24
Instruction Fuzzy Hash: 44B1A530B042198BDB08EBB9985567E7BB7BFC8710F14892DD406D7399DE38CC069B92

Function 061E5598 Relevance: 1.8, Strings: 1, Instructions: 598COMMON

Download Yara Rule

Strings

$, xrefs: 061E58DB

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 03900d41ff10d54229a2fbde1f654124e44e0e7643a21568302415ee03863303
Instruction ID: 171144d1e506ffcc33f0a83390bd987a8fe89e9128b52bb693b193b8788f65c9
Opcode Fuzzy Hash: 03900d41ff10d54229a2fbde1f654124e44e0e7643a21568302415ee03863303
Instruction Fuzzy Hash: 0D22E135E006158FDF64DBA5C5906AEBBF3EF84318F24846AD40AAB344DB36DD42CB91

Function 00933E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 009340CB

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: c011f98131464296836bffff7904f38717a76e83b92a4d56712470c180f45a9d
Instruction ID: e97c6df45662296769258935f5fb1e8ad14015aeb8df1925d41516b85d53c875
Opcode Fuzzy Hash: c011f98131464296836bffff7904f38717a76e83b92a4d56712470c180f45a9d
Instruction Fuzzy Hash: B2917C70E00209CFDF14CFA8C98579EBBF6AF98314F148129E415A7254EB74A986CF81

Function 00933E76 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

\Vl, xrefs: 009340CB

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: d6a61c6e7dd3c9fe9e37da2a5c603b738e07ad25242de89418839d330b41efb0
Instruction ID: e212ad5dba51eae785ad72aa36cca7f516528138e678103e5b8f2af5b6705136
Opcode Fuzzy Hash: d6a61c6e7dd3c9fe9e37da2a5c603b738e07ad25242de89418839d330b41efb0
Instruction Fuzzy Hash: D0A17B70E0420ADFDF14CFA8C9857DEBBF5AF98314F148129E414A7254EB74A986CF81

Function 061E65E8 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60d1d104dade7293b00c3b79bea4fba48ad4ff022e94bf7afc4c70e4ebf5767
Instruction ID: c682d3c49db2b7cd2dca30b7c937afee0cffbfec34bdd9da4cfd76f9a8f2e68d
Opcode Fuzzy Hash: c60d1d104dade7293b00c3b79bea4fba48ad4ff022e94bf7afc4c70e4ebf5767
Instruction Fuzzy Hash: C462AD34F006048FDB64DB68D594AADB7F2EF88314F548869E40ADB3A5DB35EC46CB81

Function 061EC170 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8be65b3991a078bedb3255f4706022c5b98440104ff190e1bb440e2a74dac39
Instruction ID: a41d41b785a8220405bc8ecf4649d65c34ed6d2c343b99264d6cc1afcb0f5042
Opcode Fuzzy Hash: f8be65b3991a078bedb3255f4706022c5b98440104ff190e1bb440e2a74dac39
Instruction Fuzzy Hash: E6329E34B006098FDB54DB68D990BAEBBB6FF88314F10842AE419E7355DB35EC46CB91

Function 0093A4F8 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3ba3997de8e90ce06e159b01963bf4aa93aee39a5267052d659b3c709fbef2
Instruction ID: b3622e3b0a84a5d523e7e2e81983fca2ba0fda44b17f5b8f28fa4417e161b2fa
Opcode Fuzzy Hash: fc3ba3997de8e90ce06e159b01963bf4aa93aee39a5267052d659b3c709fbef2
Instruction Fuzzy Hash: 67D1AF71A002058FDB14CF68D8847AEBBBAFF89310F24856AE409DB395D734DD45CB92

Function 00934A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869ec8bec85bcd6f06ae6e183f3cbb0fe459146450b164c072735e45f88a376f
Instruction ID: 5b387d5556682b8bd4d3a6a422fdf04de0d546da5ab563eccb3ee1e13963fa25
Opcode Fuzzy Hash: 869ec8bec85bcd6f06ae6e183f3cbb0fe459146450b164c072735e45f88a376f
Instruction Fuzzy Hash: 21B13D70E002098FDF10CFA9D9857EDBBF6AF88314F158529D859E7294EB74A885CF81

Function 061EACC8 Relevance: 12.9, Strings: 10, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061EAE6B
$]q, xrefs: 061EADE9
$]q, xrefs: 061EAE48
$]q, xrefs: 061EAEA0
$]q, xrefs: 061EAE3C
$]q, xrefs: 061EAE77
XMm, xrefs: 061EB17A
$]q, xrefs: 061EADF5
$]q, xrefs: 061EAE94
XMm, xrefs: 061EB099

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: XMm$XMm$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3681692842
Opcode ID: e4c4b562bfde2cd23b935e659117734d987a06e0572f1b5e5808cea31c97a276
Instruction ID: 5e42a2a539622d5cb00ed7de7ae3347ea15437487303f7f68b232d964abfa466
Opcode Fuzzy Hash: e4c4b562bfde2cd23b935e659117734d987a06e0572f1b5e5808cea31c97a276
Instruction Fuzzy Hash: A2E18230E106098FCB69DFA9D5906AEB7B6FF85310F10892AE809DB354DB35DC46CB91

Function 061DB228 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Sn, xrefs: 061DB3B6
Sn, xrefs: 061DB3DB

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: HandleModule
String ID: Sn$Sn
API String ID: 4139908857-2618209287
Opcode ID: dca40d8987f317beb3718638b71d10868489fd1976a2b10a1ecbaf02ef4c5567
Instruction ID: 86c98a7a0d2b8e00904e41217287f8e8e736839bd281203952f9d2296a79efca
Opcode Fuzzy Hash: dca40d8987f317beb3718638b71d10868489fd1976a2b10a1ecbaf02ef4c5567
Instruction Fuzzy Hash: AC7132B0A00B059FDBA4DF6AD44475ABBF5FF88704F00892ED48A97A50DB74E909CB90

Function 061E9148 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061E91B8
$]q, xrefs: 061E91F3
$]q, xrefs: 061E91C4
$]q, xrefs: 061E91FF

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 70f02c71fac8cdd473458b6e3a548c3df8edcffc5703b25424dbd487b60720cc
Instruction ID: 14e52bd97b4c67bdf30c93c507893bdffa8c6f48ca609d719ecd6fc6cbd09285
Opcode Fuzzy Hash: 70f02c71fac8cdd473458b6e3a548c3df8edcffc5703b25424dbd487b60720cc
Instruction Fuzzy Hash: 73913230F0061A9FDB54DF65D850BAE77F6AFC8204F10896AD809DB394EB70DD468B91

Function 061ECF30 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061ED33B
$]q, xrefs: 061ED327
$]q, xrefs: 061ED32F

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 9c89c8ee9e07f42ad758effc6f9051492efec016598f46cdd32494daf30dd640
Instruction ID: 3abae414138dcfd4f4d8a80ad9690ba6a2d3abb0c6747fcaa2f515848ed08f1d
Opcode Fuzzy Hash: 9c89c8ee9e07f42ad758effc6f9051492efec016598f46cdd32494daf30dd640
Instruction Fuzzy Hash: 23623F30A0060A8FCB55EF68E590E5EB7F6FF85304B208969D0059F369DB75ED4ACB81

Function 061E4B68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 061E4CB9
fbq, xrefs: 061E4B93
\Obq, xrefs: 061E4D43

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 211d3b0c03335df4b647642c68fdd7bef566d924cb81f8b6f57907bafec61ebc
Instruction ID: 95af29f383caa7381759b44adbb67ca79c9f7199e62edac57b6d6e1cdc5edf35
Opcode Fuzzy Hash: 211d3b0c03335df4b647642c68fdd7bef566d924cb81f8b6f57907bafec61ebc
Instruction Fuzzy Hash: 19617230E002199FEB549FA5C4547AEBBF6FB88300F20842AE109AB395DF758D458B95

Function 061E9138 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 061E91B8
$]q, xrefs: 061E91F3

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 8b86dc52162dd622ef742762ca8a3fc7162cd3f8755c3e035fd5e26cb844c2b3
Instruction ID: bcd53deff77612d0a7bce661295510b73395a2c80896384b1c0cd09af319f4b8
Opcode Fuzzy Hash: 8b86dc52162dd622ef742762ca8a3fc7162cd3f8755c3e035fd5e26cb844c2b3
Instruction Fuzzy Hash: 76515430B005059FDB54DF74D860BAE77F6ABC8650F10886AD809D7394EB30DD46CB91

Function 061E4B58 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

XPbq, xrefs: 061E4CB9
fbq, xrefs: 061E4B93

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 47fa0549eefd9270d57065f4eb4843b3b690849b929636adb94d3786d1d2bcd2
Instruction ID: a52605c35f709b91be6c44528bac73c4a497a38f3e7c6bff846f00f5f9d44cd0
Opcode Fuzzy Hash: 47fa0549eefd9270d57065f4eb4843b3b690849b929636adb94d3786d1d2bcd2
Instruction Fuzzy Hash: 1B518030F002189FDB549FA5C855BAEBAF6BF88700F20852EE105AB395DB758D058B91

Function 0093EB18 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cfaa192f79992530b190f0b2181db09a5128ae842115b8f20c251db9c894488
Instruction ID: 044f5e7fc44f0bca446bb674e23ee746708a7e10110cbf073282c94fa81003b7
Opcode Fuzzy Hash: 3cfaa192f79992530b190f0b2181db09a5128ae842115b8f20c251db9c894488
Instruction Fuzzy Hash: 24412372D043598FCB10DFB9D8446EEBBF5AF89310F14856AD408A7380EB389945CBE0

Function 061DD804 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 061DD922

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6add7ec6b902a891aa7f52ff833d96eef887871725af7df4fce72e3be0897c8a
Instruction ID: bcdecaf4c133afb3c836b182c4e6a2d22b7f73e36c0355d09535b3dbd59a8e77
Opcode Fuzzy Hash: 6add7ec6b902a891aa7f52ff833d96eef887871725af7df4fce72e3be0897c8a
Instruction Fuzzy Hash: CA51C0B1D10349AFDB14CF99D984ADEFFB5BF48310F24852AE419AB210D775A885CF90

Function 061DD810 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 061DD922

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 810396f64b0a67efcc8b0ffe57ed9648a5b8d49b348558fad876bcc29e83e965
Instruction ID: cc83c66a2bd6410657bc96ef12cf0e280f2c57669045369f307d341bda432278
Opcode Fuzzy Hash: 810396f64b0a67efcc8b0ffe57ed9648a5b8d49b348558fad876bcc29e83e965
Instruction Fuzzy Hash: 4E41BFB1D10309DFDB14CF9AD984ADEFBB5BF48310F24812AE818AB210D775A885CF90

Function 061DCD6C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 061DFE91

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cfa8d07d5eb368a965838a5d2de555678a196fe7a56750058453d2da6b792ae4
Instruction ID: 04cba3d57ad44ff838ac8cb38f9c51a2f17b97f48463f3449b424918f5e55e61
Opcode Fuzzy Hash: cfa8d07d5eb368a965838a5d2de555678a196fe7a56750058453d2da6b792ae4
Instruction Fuzzy Hash: 0B413AB4900309CFCB54CF9AC848AAAFBF5FF88314F25C859D519A7321D334A945CBA0

Function 061D3048 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061D30D7

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d65850fde103bb8c3427a20fcc705d6645d0790f92f8954bb7ba7b6329b94f07
Instruction ID: df7b287efae30e32a627897b4a2db4c69611a958b196d90fcc57dd568377ec34
Opcode Fuzzy Hash: d65850fde103bb8c3427a20fcc705d6645d0790f92f8954bb7ba7b6329b94f07
Instruction Fuzzy Hash: 9B21E4B5D002099FDB10CFAAD584AEEFBF5FB48310F14841AE918A7350D379A940CFA1

Function 061D3050 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061D30D7

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bae0a1ca56be401a7dced51c6177491257a508151d00608bb2270c55499722b2
Instruction ID: af33294f9ad3b91756672b4822324f2e319f4a8bd090144960cfcc041a49ea13
Opcode Fuzzy Hash: bae0a1ca56be401a7dced51c6177491257a508151d00608bb2270c55499722b2
Instruction Fuzzy Hash: 1A21C4B5D002499FDB10CF9AD984ADEFBF9FB48310F14841AE918A3350D379A944DFA5

Function 061DB679 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,?,?), ref: 061DB6EA

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2a07bbdd67f2813ad2fd07a28f563cfb96b6804dc1d7a7b050c00769f3dc052d
Instruction ID: 6590a4a6eb44717c606d9009515f9a72d13ecf3fde82265f0eec8a3c4dee94c3
Opcode Fuzzy Hash: 2a07bbdd67f2813ad2fd07a28f563cfb96b6804dc1d7a7b050c00769f3dc052d
Instruction Fuzzy Hash: 3D1114B6C042499FCB10CF9AD844ADEFBF8EB48320F10841EE419A7210C779A545CFA5

Function 0093E708 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0093EB6A), ref: 0093EC57

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 0bc8e92b84ffa11b02004129b7cfc1015dcb9a5ee8a9ac04bb74fb42c6a5c02a
Instruction ID: f0dac20bb0411219e030ba9dbf0d2b8781f31afb5dfe4b398b686f16e35ce7c5
Opcode Fuzzy Hash: 0bc8e92b84ffa11b02004129b7cfc1015dcb9a5ee8a9ac04bb74fb42c6a5c02a
Instruction Fuzzy Hash: B01100B1C0065A9BCB10DF9AC544BAEFBF4EF48320F14816AE918B7240D778A940CFE5

Function 0093EBE8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0093EB6A), ref: 0093EC57

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f6319255ec51915cbf509cdaa50948d300e2a5d023848fcd40496df5a922588b
Instruction ID: 3a92a39c24478ac321dab7242b6d7c398670f4b0656d7528c4e323441a8059a1
Opcode Fuzzy Hash: f6319255ec51915cbf509cdaa50948d300e2a5d023848fcd40496df5a922588b
Instruction Fuzzy Hash: 9F1123B1C006599BCB10DFAAC544BDEFBF5BF48320F14816AD428B7240D378A944CFA1

Function 061DB680 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,?,?), ref: 061DB6EA

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27289a69784f5d80759a5f656449a2d92bb11e135f549fbb6e8b9609905e9322
Instruction ID: 2e96f2e994eac3da17627fb320e3d248435498d0ce385b1287684e4906c37ac3
Opcode Fuzzy Hash: 27289a69784f5d80759a5f656449a2d92bb11e135f549fbb6e8b9609905e9322
Instruction Fuzzy Hash: 2311F3B6C042499FDB10DF9AD944ADEFBF8EB48320F10842ED519A7210C379A545CFA5

Function 061DA17C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,061DB244), ref: 061DB47E

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 72f656310d315646b8b2461d5245a0029303c3d713cdf5a4bec26230f4c689cd
Instruction ID: 30d47a92eb8baae086f4934cfd6621486eb78ba7b25ed7bf5fb03e3a52539f9c
Opcode Fuzzy Hash: 72f656310d315646b8b2461d5245a0029303c3d713cdf5a4bec26230f4c689cd
Instruction Fuzzy Hash: 96110FB5C043498FCB20DF9AC544ADEFBF4EF88624F11842AD91AA7210D379A545CFA1

Function 061EDAB8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 061EDC01

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d431314767d23e4f6610b4508879927ddf1a0753c8c595058681db7fbf385cf9
Instruction ID: 39644b11bf8d9329f8413d177f540e69be7cb8b187dbb19057de91c0792d831a
Opcode Fuzzy Hash: d431314767d23e4f6610b4508879927ddf1a0753c8c595058681db7fbf385cf9
Instruction Fuzzy Hash: 4841AF30E00609DFDB64DF65E8506AEBBB6FF85300F208929E406E7350EB70D946CB81

Function 061EDAA5 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH]q, xrefs: 061EDC01

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fec8e479cc1273658fadc74bc532154a8af08bab06d626435cef8f09de3cfe5b
Instruction ID: ebd7ed5a62414bbf0e638bea90afbc2569849cbabe506ff9f72b565c2ba494a8
Opcode Fuzzy Hash: fec8e479cc1273658fadc74bc532154a8af08bab06d626435cef8f09de3cfe5b
Instruction Fuzzy Hash: 2A41C230E006499FDB65DF65E88069EBBB6FF86300F208529E405DB350EB70D946CB91

Function 061E21BD Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PH]q, xrefs: 061E230B

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 59ed09438f50e49a69d1fe6b1c50eb0cc946c1152c63f9b831b7c70d243b9e8b
Instruction ID: fc8622a7de6c7009225a7f6a9fc5ed8152197b9941ff475718ed5dbd15e441d1
Opcode Fuzzy Hash: 59ed09438f50e49a69d1fe6b1c50eb0cc946c1152c63f9b831b7c70d243b9e8b
Instruction Fuzzy Hash: C731E030B102029FDB489F74C864A6E7BEBAF89240F144479D406DB395DF35DE46CBA5

Function 061E21D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 061E230B

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 3d648a8c08c9ee907006bb49eebb8fd596b4bc670ddb60179f84d6b843c3f142
Instruction ID: c149ebbc87d5d367e40ce9a0f256929284c06ac145c2e6c8001a20d53fd0c0b6
Opcode Fuzzy Hash: 3d648a8c08c9ee907006bb49eebb8fd596b4bc670ddb60179f84d6b843c3f142
Instruction Fuzzy Hash: 5431F230B102028FDB489B74D924A6E3AEBAF89300F20443DD406DB395DF35DE06CBA5

Function 061E82C8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 061E8313

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 5e73e88032fd22e44547c5124503b275a0a282992bc58e625dd32880fb2efbee
Instruction ID: fa91046d10013f9ef222548d41810ff607d9bcf9569c6d45fecd2a1929f4b200
Opcode Fuzzy Hash: 5e73e88032fd22e44547c5124503b275a0a282992bc58e625dd32880fb2efbee
Instruction Fuzzy Hash: 51F0FF31F00604CFDFE9DE58E991A6C73A5EB44210F09486AD908CB354D731D90ACB91

Function 061EB220 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf545d8cb6185950d8c39f55327d7fc5bf146dc479c67374a558c02d15fbfb4
Instruction ID: 1af43b246f8744eeca90a7d4c11a88f49600b7b26cd9f34256e098d172ce0ed3
Opcode Fuzzy Hash: ccf545d8cb6185950d8c39f55327d7fc5bf146dc479c67374a558c02d15fbfb4
Instruction Fuzzy Hash: 45A18570F045098FDF64DBA9D690BAE77A6EF89310F20482AE409E7395CB38DD45C752

Function 061E61E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c99e7ff66f94cf0aa9198d4ae9e57d8d863dcd0ae8ae1a3dcfe6ab41974ed0
Instruction ID: 25e3d5b8aa34ebc291c1ee7a17e2f974a12bc18eb9f11174109a75c4f8767c75
Opcode Fuzzy Hash: 67c99e7ff66f94cf0aa9198d4ae9e57d8d863dcd0ae8ae1a3dcfe6ab41974ed0
Instruction Fuzzy Hash: 1E61C171F005124FDB549A7EC88095FBADBAFE4220B554439D80EDB364DFA9DD0287D2

Function 061E4299 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a76deafb2a65c6ed1590a48a2f7964bc44abe0ee1212f31450caaab2e71f1f7
Instruction ID: e034884b7f3a9a55802391f7e2e7b7c342ac1b856f8fdb51f276fdfd9cabc17b
Opcode Fuzzy Hash: 5a76deafb2a65c6ed1590a48a2f7964bc44abe0ee1212f31450caaab2e71f1f7
Instruction Fuzzy Hash: 36813E30B1060A8FDF94DFB9D4546AEB7F2AF89304F118529E40ADB394DB34DC468B92

Function 061E42A8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22ecf62ab5551803bbaf255ef4c2a480e9f5824efa7d6b4e8d106d7e23c97e2
Instruction ID: b27aefc6a7138d904e9805a2e19d9ca1037ee07dfc806b1c6631a2d1a14312c2
Opcode Fuzzy Hash: a22ecf62ab5551803bbaf255ef4c2a480e9f5824efa7d6b4e8d106d7e23c97e2
Instruction Fuzzy Hash: A5812D30B1060A8FDF94DFB9D45469EB7F2AF89304F118529D40ADB394DB74DC468B92

Function 061E45BC Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c89ee9a52b93341debb143b198eed826443db45f93d517ad81004822cd0fbde
Instruction ID: acdf10fe5f180a939edf6271a9c7f81e48d750b64c18ddb0683229eda724234f
Opcode Fuzzy Hash: 6c89ee9a52b93341debb143b198eed826443db45f93d517ad81004822cd0fbde
Instruction Fuzzy Hash: D3914D34E006198FDF60DF68C890B9DB7B1FF89300F208699D549AB355DB70AA85CF91

Function 061E45D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda0fdb01050be4d7fa8336be2b504104449cd80996a4b6cb589e19a386727d
Instruction ID: a95c0296e173098bca64fac44b8f9983982a7ef714f79899f42cc4db28245990
Opcode Fuzzy Hash: 5cda0fdb01050be4d7fa8336be2b504104449cd80996a4b6cb589e19a386727d
Instruction Fuzzy Hash: DC913C30E106198BDF60DFA8C890B9DB7B1FF89304F208699D549AB355DB70AA85CF91

Function 061EEAF8 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d504507709191ea8fffda249874cc4baf91018f985c27d7e6f9bf65f74a86154
Instruction ID: 224829ddf2f3366148ad92fd0825e6a2a5a44d0a4a1a37414315b137ff45a09a
Opcode Fuzzy Hash: d504507709191ea8fffda249874cc4baf91018f985c27d7e6f9bf65f74a86154
Instruction Fuzzy Hash: 1B813A70E006099FDB54DFA9D990A9DBBF6FF88310F24842AE405EB355DB30E946CB51

Function 061EEB08 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df28324f122804c268acf0cb011c9e7ce0b45c4dbaf984a61cd063f4cde2877a
Instruction ID: 8bcc4827a8d16b85d6d35c5f25ccb08bf91786e2666a8e07c14fe26756e63bba
Opcode Fuzzy Hash: df28324f122804c268acf0cb011c9e7ce0b45c4dbaf984a61cd063f4cde2877a
Instruction Fuzzy Hash: 01710770E006099FDB54DFA9D990A9EBBF6FF88310F14842AE405EB365DB30E946CB51

Function 061EFA1A Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50de8ae9f4e39cf3c5aff4d23835af1b7823c7b49b033029e915c94fb21b9cc0
Instruction ID: e48a86c87958e8cfb2714df6924ccb487c0545c6a6370efaad7994cc65b4dac2
Opcode Fuzzy Hash: 50de8ae9f4e39cf3c5aff4d23835af1b7823c7b49b033029e915c94fb21b9cc0
Instruction Fuzzy Hash: 4051F870B502049FEF6456ACE854B7F765EDB89310F204526E80AC73A9CB6CCC4B93E2

Function 061EFC78 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e8758c60221853d515579cad31a01d9b1118bd2b823321ff1fcc0b2e45fc76
Instruction ID: a3b3815c728d829d66c49e9e821140285a5477c9e45a218711d6cbddea26e1d3
Opcode Fuzzy Hash: 51e8758c60221853d515579cad31a01d9b1118bd2b823321ff1fcc0b2e45fc76
Instruction Fuzzy Hash: 24510135E00909CFDB14EB79E8446ADBBB2FB84311F208869E90AD7251DB35D846CB81

Function 061EFA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfe47bf53b189b3c361db0ca64e910d3e77eb85b0810c58e46519a8e12e20df
Instruction ID: df247c0fa805d2472e203e8c6b30ef2d1259ac1903a077075ec55eb6018c31e0
Opcode Fuzzy Hash: 9bfe47bf53b189b3c361db0ca64e910d3e77eb85b0810c58e46519a8e12e20df
Instruction Fuzzy Hash: 7E51B770F506049FEF64566CE954B2F765EDB89310F204826E80AC73A9CB6DCC4B97D2

Function 061E5420 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961ae0b7d644737a36038cfc678a8c50a178abf310611ed5aea5ccf7845f33cf
Instruction ID: eba013de1661156515675d7cdf5e12bcf65205d80bc336080e548623d115137f
Opcode Fuzzy Hash: 961ae0b7d644737a36038cfc678a8c50a178abf310611ed5aea5ccf7845f33cf
Instruction Fuzzy Hash: 0D415171E00A099FDF70CEA9D8C0AAFFBB2EB84314F10492AE116D7650D731E9558B91

Function 061E2081 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ad4592791ad4fd79bd5616fb8407be037367c9e0d164e516acd294450ff578
Instruction ID: 61b212ac9505c1df20cbb9c0fd56d5095cef795df8eef5e721e74a07e7f29e6f
Opcode Fuzzy Hash: 18ad4592791ad4fd79bd5616fb8407be037367c9e0d164e516acd294450ff578
Instruction Fuzzy Hash: C5418331E106059BCB55DFA4D8A4A9EBBF6EF89310F148929E805E7350DB71EE46CB40

Function 061E2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43e4d2ecced3c6395350192d1289dd199b59562fe81520e4823fd6eb4accaa5
Instruction ID: 5fbd5d704d8e8ef2b2ad69908254505375019f4d4066442c4bbf8fbc3e85a5db
Opcode Fuzzy Hash: e43e4d2ecced3c6395350192d1289dd199b59562fe81520e4823fd6eb4accaa5
Instruction Fuzzy Hash: 26316231E106099BCB55CFA5D864A9EF7F6BF89300F108929E806E7350DB71ED46CB51

Function 061E3A99 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa39206690c6776916a6a656130a999106c59b5b5b77919ce33af3fd1d9beee
Instruction ID: 5965a5394ec6c2e814d7885ebbd2cca23b9513edf92ba46835e7e0307867e590
Opcode Fuzzy Hash: 2aa39206690c6776916a6a656130a999106c59b5b5b77919ce33af3fd1d9beee
Instruction Fuzzy Hash: 3921BF75F016059FDF50CF68D880AEEBBF6AB88300F05802AE515E73A1D730D946CB91

Function 061E3AA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4ae41adba5d9311c859eb8fa78c73b412f0a4652348b8b2b29e4961bdd30b8
Instruction ID: 6f6f3c806326db02cf3bcacfa3310db0f856827cf3c7db33fce42b34f969d65b
Opcode Fuzzy Hash: 0d4ae41adba5d9311c859eb8fa78c73b412f0a4652348b8b2b29e4961bdd30b8
Instruction Fuzzy Hash: E221B071F006059FDF50DF69D880AAEB7F5EB48310F11802AE915E73A0E730D842CB91

Function 006ED044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242815448.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458ffcbebed179997433fe5d5fedc019a13a2511409617882d252e0979b32455
Instruction ID: e74f3022497b0b568a6db7128387d71c6ecc8a21b3c349439ce54048a5726a43
Opcode Fuzzy Hash: 458ffcbebed179997433fe5d5fedc019a13a2511409617882d252e0979b32455
Instruction Fuzzy Hash: EC21F271504384AFCB15DF24C9C4B26BB66FB84314F28C569E9494B392C73AD847DA62

Function 061E6D10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334123809b015114559ae53e451910b7513b7598dc03f45087a37bc41f0382ba
Instruction ID: 1346d3b8e4e3f3f42458c660f97dcdf80b0b7e83e1ea5d5fad7225173e70e6a8
Opcode Fuzzy Hash: 334123809b015114559ae53e451910b7513b7598dc03f45087a37bc41f0382ba
Instruction Fuzzy Hash: 6F21A234F104189BDF44EB69E864A9EB7B6FB84310F648429E409DB354DB31ED468BC1

Function 061E3058 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f98c389aa3f2c1e83a91670a3259f46c562c9ac911b258b19ce0ca5138cc20
Instruction ID: 6f974adab771d4c2fab7dc6efa369ba38040d59396e03c159a443c5961359f07
Opcode Fuzzy Hash: e3f98c389aa3f2c1e83a91670a3259f46c562c9ac911b258b19ce0ca5138cc20
Instruction Fuzzy Hash: FB119071E002189BCF58DB69D8915DEF7B6EB88310F10896AE51AE7340EB31DA41CB91

Function 061E3BB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601faf364245d3a318ee9b7483aeef850c7eb18f645aeed4245f795b8d96b6d2
Instruction ID: 36d3513b8e10c82cece1e8df48d0611b6aa99fcec28783f052862da525f5a6dc
Opcode Fuzzy Hash: 601faf364245d3a318ee9b7483aeef850c7eb18f645aeed4245f795b8d96b6d2
Instruction Fuzzy Hash: 9E118E36B105294BDF549678D8146AE73AAABC8610F01853AD40AEB344DF39DC068B92

Function 061E41FA Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c935a9f01872d521138b4a55c63cc5094ebf1b1c0c93883830eaea55e4ac16ee
Instruction ID: e9e307ca6a7b13c27b089631947f0648446ebd3858d508d1ed3b9a0b171f50a0
Opcode Fuzzy Hash: c935a9f01872d521138b4a55c63cc5094ebf1b1c0c93883830eaea55e4ac16ee
Instruction Fuzzy Hash: 4201D435F115110FDB61867DE815B5FABEACBCA310F15843AF00ECB355EA25DD068391

Function 061E3870 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfedd5dd91fd3e2984b1731b32f0b79d858931b09574a5d650774f5574ebbc5
Instruction ID: a76095548f73ab23cde60580cd1fee97ef37094aaee687533b3d0a472ae1d3b6
Opcode Fuzzy Hash: 4bfedd5dd91fd3e2984b1731b32f0b79d858931b09574a5d650774f5574ebbc5
Instruction Fuzzy Hash: B621E3B5D016199FCB00DF9AD984ADEFBB4FB48320F10862AE928A3240D374A554CFA4

Function 061EED79 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f265ee8ec11c43427a75bdb8e4b38fc824fe9c8ac8b4e84ab6f031ee7eb961
Instruction ID: a90cd4fa8088662bbcb5955b226e1e556f62fa9dc5dcaf5c0f3b48a572d68bbb
Opcode Fuzzy Hash: 27f265ee8ec11c43427a75bdb8e4b38fc824fe9c8ac8b4e84ab6f031ee7eb961
Instruction Fuzzy Hash: 0901F139B005110FCB16CA6DD854B2F7BE6EBCA710B14843AE50AC7340EB29CC068796

Function 061EA2F9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c33fb0dc8a224910f7a5758865dc0ed910c4c6bbf23877545f50b06f96375a2
Instruction ID: d6ba9a4c2d358c7ab57e9301c60ccfd4122f78554f7976a5244682af5a8970a7
Opcode Fuzzy Hash: 0c33fb0dc8a224910f7a5758865dc0ed910c4c6bbf23877545f50b06f96375a2
Instruction Fuzzy Hash: 1D01D434B005105FCB52D638E965B5F6BE6EF86310F158429F40EC7362EB24DD078791

Function 006ED03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242815448.00000000006ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ed000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 562347e5dd150f34de4fcc9ab705463891bfc12c4b8caea7be40300fcfdf819a
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3D11BB75504384CFCB12CF10C9C4B55BBA2FB84314F28C6A9D8494B392C33AD84ACB62

Function 061E3878 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a282da9811dad140c9d025b1cccfe8c0843c9c89488f4b2fdff59b44c69d06
Instruction ID: f85462e477f23d62d0e9fcac237aaae6c392280417a846e7091cbd236e20ef62
Opcode Fuzzy Hash: 54a282da9811dad140c9d025b1cccfe8c0843c9c89488f4b2fdff59b44c69d06
Instruction Fuzzy Hash: FF11D3B1D012599FCB00DF9AD984ADEFFB4FB48310F10812AE918A7200C374A954CFE5

Function 061E4208 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e775f6fcd7c0b22da3cfa95ffa92990ac09baf47e48c19a5056a78d4183f5f
Instruction ID: 208cdb14c65099ca8794cecd8e6a24c6db4146a42bc8c43539063ea1ed85a27c
Opcode Fuzzy Hash: b0e775f6fcd7c0b22da3cfa95ffa92990ac09baf47e48c19a5056a78d4183f5f
Instruction Fuzzy Hash: 5901AD31F104110BDB6496BEE415B2FA6DACBC9710F108839F50EC7344EE65DC0243D5

Function 061E3BA7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6479179ea9b91f5782631cab30740f3a4a474ad127b41ad625d125c54b8466c
Instruction ID: 12004def4047a62f7813f05b023bc7fdd310e6bae4829edb1ac1a40c07373588
Opcode Fuzzy Hash: f6479179ea9b91f5782631cab30740f3a4a474ad127b41ad625d125c54b8466c
Instruction Fuzzy Hash: DA01DF36B104295BDF849678DC186EF76AB9BC8610F09403EE41AE7240EF65DC0A87D2

Function 061EED88 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7291b1a4c392bac483059c2e370acb659336571eddbae622e5159316e9f9849
Instruction ID: 6dbac087136d8702229e03699e3d91212f734db806714064dfce165c15e388a8
Opcode Fuzzy Hash: d7291b1a4c392bac483059c2e370acb659336571eddbae622e5159316e9f9849
Instruction Fuzzy Hash: CA018139B105150BCB65956DD454B2F6BEADBC9720F148839E50AC7340EF65DC034385

Function 061EA308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0110145f82480f37dcf1834c73656b031bde624769cadeb5a54edfd580f632f1
Instruction ID: 0783c6741cde2afb8719d2ae72df7162920530a52349625777279e6f1834f372
Opcode Fuzzy Hash: 0110145f82480f37dcf1834c73656b031bde624769cadeb5a54edfd580f632f1
Instruction Fuzzy Hash: 87018130B005144FCB61EA29E955B1FB7EAEB89710F108439E50EC7355EF25DC078785

Function 061EC7C8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13fb097e8e1bfcdcf3458b07c37100dd1c6a507523723d399604bfc08aed1743
Instruction ID: 9e3314c5ac04a789eb9c6831b8a0b648196208b4c50daf7781d2ccabe1bc0fef
Opcode Fuzzy Hash: 13fb097e8e1bfcdcf3458b07c37100dd1c6a507523723d399604bfc08aed1743
Instruction Fuzzy Hash: D501A432E101289BCF58AA69ED51E9EB779FB84314F10453AE911E7345DB32E8058BD4

Function 061E6469 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d80d0160c731ed8d8f731a24758617d9f9931f75c3b037006a7a7b78fe27e3
Instruction ID: e8bb6cd9884695adebab091c858d50638afc78991f20946f95c2e6852983ee66
Opcode Fuzzy Hash: c4d80d0160c731ed8d8f731a24758617d9f9931f75c3b037006a7a7b78fe27e3
Instruction Fuzzy Hash: D1E026B2E24549ABEF90CEB0CE0839B7B6AD751304F2848A6E408DB201F276CE0083C0

Function 061E6478 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction ID: 6baad63b7a64735e9a59453dfc5e021fd2f7f6a4c463e473184db4e47c19035c
Opcode Fuzzy Hash: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction Fuzzy Hash: 14E02B71E1050DABDF50DEB0C90575EB7ADD701304F6088A6D408C7201F372DE0187C0

Non-executed Functions

Function 061E7698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 061E77B1
$]q, xrefs: 061E77EE
$]q, xrefs: 061E7C19
$]q, xrefs: 061E77BD
$]q, xrefs: 061E7B7A
$]q, xrefs: 061E7C23
$]q, xrefs: 061E77E2
$]q, xrefs: 061E7C0D
$]q, xrefs: 061E7C2F
$]q, xrefs: 061E7B6E

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: b9ccc960def6c6fab1ab473ca15e0d7922dd3ec2b1fb9448e80dc7be13fe7d1b
Instruction ID: b21ca51beea2031193950f4b934ebe5f8744dc31bf226d8d53e25c28da2d4c2a
Opcode Fuzzy Hash: b9ccc960def6c6fab1ab473ca15e0d7922dd3ec2b1fb9448e80dc7be13fe7d1b
Instruction Fuzzy Hash: A2122F30E006198FEB68DF69D894A9DB7F6BF88704F208969D4099B3A5DB30DD45CF81

Function 061EE390 Relevance: 4.3, Strings: 3, Instructions: 573COMMON

Download Yara Rule

Strings

PH]q, xrefs: 061EE5F0
0o@p, xrefs: 061EE428
Dq@p, xrefs: 061EE434

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: 0o@p$Dq@p$PH]q
API String ID: 0-3731290017
Opcode ID: 21a64b5d2a9a83371db7cd510cf3b75a4d63b94b7213b311f1d3a472646c0dc1
Instruction ID: 7f6a8b16d8d24f3d6b8f1cb83fb59406c04e5bf641d3cfbd22d13931ae3a7e5c
Opcode Fuzzy Hash: 21a64b5d2a9a83371db7cd510cf3b75a4d63b94b7213b311f1d3a472646c0dc1
Instruction Fuzzy Hash: 3522AF30B005058FCB54DB68D494AAEB7F6FF88310F248969E40ADB365DB35EC46CB91

Function 061E5CF0 Relevance: 2.9, Strings: 2, Instructions: 417COMMON

Download Yara Rule

Strings

\Obq, xrefs: 061E5E55
XPbq, xrefs: 061E5E25

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: XPbq$\Obq
API String ID: 0-409418754
Opcode ID: 86c6ae6c16013987735b57413a9dc7232544280525454b9e10fa6935f9555314
Instruction ID: 80865bdd811f09cae360b28a5e570f881d94755aaa134aa4a45d77661753e87f
Opcode Fuzzy Hash: 86c6ae6c16013987735b57413a9dc7232544280525454b9e10fa6935f9555314
Instruction Fuzzy Hash: B2D1E335F105148FDB949B68D894AAEBBF2FF89324F24846AE006DB351CB36DC418B91

Function 00931A44 Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

L, xrefs: 00931C70
PLl, xrefs: 00931CD4

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: L$PLl
API String ID: 0-3827219774
Opcode ID: 2f1925b4655eb83098ef54175869f47b8668df7b0510eb50c6d59b7ddaa7f337
Instruction ID: 35af70aaec16ee52f8f57c79089867cc5977badfb87419aa52402766bd72599b
Opcode Fuzzy Hash: 2f1925b4655eb83098ef54175869f47b8668df7b0510eb50c6d59b7ddaa7f337
Instruction Fuzzy Hash: FA91BE558AE3E16EEB036B3C19B44D67FB49D83214B0A15D3C0D0CE0B7D54C899ED7AA

Function 061E0040 Relevance: 2.0, Instructions: 1968COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d132700234cdabd66cce6ac15a0219d5cff059fd251d926007b16ecf58c5c0d0
Instruction ID: 16f1d75a27bc817133d52177c9f766d16ca9edeed0a0a6b5d0b731a3f2143c0e
Opcode Fuzzy Hash: d132700234cdabd66cce6ac15a0219d5cff059fd251d926007b16ecf58c5c0d0
Instruction Fuzzy Hash: 4223FA31D10B198ACB11EF68C8946ADF7B1FF99300F15D79AE448B7221EB70AAD5CB41

Function 009341C8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vl, xrefs: 0093447F

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 47af029e31556c0416511d831fed8313f7c43986d939a0ebf77e8b1597565a7c
Instruction ID: a00e563c2db867e931dd6a452654e73c9551970a0cc4ccd3c04049bedc975853
Opcode Fuzzy Hash: 47af029e31556c0416511d831fed8313f7c43986d939a0ebf77e8b1597565a7c
Instruction Fuzzy Hash: 73B13F70E00209DFDF14CFA9C9857AEBBF6BF88314F158529E815A7294EB74A845CF81

Function 009341BE Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

\Vl, xrefs: 0093447F

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: e91b666d341e2a68a98cf1620d6e7b49b3ba98cf1fa0fb5011f3f07c991f79bf
Instruction ID: 40475abe1abf8295045c588b50d0f041eea4d4a616ce11f03ddb8121611fe23a
Opcode Fuzzy Hash: e91b666d341e2a68a98cf1620d6e7b49b3ba98cf1fa0fb5011f3f07c991f79bf
Instruction Fuzzy Hash: 7FB14D70E0020ADFDF10CFA9C98579EBBF5BF88314F158129E815A7254EB74A885CF91

Function 00931BA1 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

L, xrefs: 00931C70

Memory Dump Source

Source File: 00000000.00000002.3243193544.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 92bb2d215252339c5935d62b0338d41ad10859a294577ab5c8269627cd7fd407
Instruction ID: 4575837a32999c9a50c10204e6763a9d095548d1562a664e20350c17b67bd475
Opcode Fuzzy Hash: 92bb2d215252339c5935d62b0338d41ad10859a294577ab5c8269627cd7fd407
Instruction Fuzzy Hash: CE31794585E3E16EDB03AB3C59B08D67FB49E43218B0E11D7C0D0CE0A7D44C989ED3AA

Function 061DA068 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c11e89a08e1526b7443405c78499f5133410cb64fda451ea6e4b901b315a01c
Instruction ID: 270ecb9f2ce88a51a13727453d0afc1a77ce5917a18790157b166aa20ca2f755
Opcode Fuzzy Hash: 3c11e89a08e1526b7443405c78499f5133410cb64fda451ea6e4b901b315a01c
Instruction Fuzzy Hash: 79A18E32E00209CFCF45DFB4C8845EEB7B2FF84310B15856AE916AB261DB75E946CB80

Function 061DBB58 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245620628.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd05f0636181cb079b786236337156fd3d130d46e093ffbc3ea3df265a674fd4
Instruction ID: d86be3e6ffd5cd203edfcf5c77c4fa5a6a240a8b01c0039eeab98ccde830bb1f
Opcode Fuzzy Hash: cd05f0636181cb079b786236337156fd3d130d46e093ffbc3ea3df265a674fd4
Instruction Fuzzy Hash: D7C129F0C817558AD728CF25E8481997BB9FB84324FD25A0ED1616B2E0EBB4166ECF44

Function 061EA930 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 061EAAEE
$]q, xrefs: 061EAA26
$]q, xrefs: 061EAAAC
$]q, xrefs: 061EAA32
$]q, xrefs: 061EAA8D
$]q, xrefs: 061EAA81
$]q, xrefs: 061EAAE2
$]q, xrefs: 061EAAB8

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 67c17b895620da46e9e6ef2afca549b6251b915fdf2a73555dc97e17f1f4378a
Instruction ID: 93703581ee7286f733e4685c27613ffefb5504f9b54e51b2c2ddeb9d3791fa94
Opcode Fuzzy Hash: 67c17b895620da46e9e6ef2afca549b6251b915fdf2a73555dc97e17f1f4378a
Instruction Fuzzy Hash: BE918F30A00609DFEB68DF65DA94BAE7BF6BF84700F108929E44197364DB74DD45CB90

Function 061E7098 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 061E75A0
$]q, xrefs: 061E7534
$]q, xrefs: 061E75AC
$]q, xrefs: 061E73E0
$]q, xrefs: 061E737A
.5uq, xrefs: 061E70F3
$]q, xrefs: 061E73D4

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 6d83bcb710e0d24f4069cf3056d1915b2b276e4b92a959e4fc97a12a1bb71625
Instruction ID: b3be96aae77a3f6f0ed244cbfa4e46237ab484c7bcc653a0603f818a31ea3a9e
Opcode Fuzzy Hash: 6d83bcb710e0d24f4069cf3056d1915b2b276e4b92a959e4fc97a12a1bb71625
Instruction Fuzzy Hash: 54F15030B00605CFEB58EFA5D594A6EB7B6BFC8300F218529D4059B3A9DB35DC46CB91

Function 061E83D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 061E869B
$]q, xrefs: 061E8636
$]q, xrefs: 061E862A
$]q, xrefs: 061E868F

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 514552dd0099bcf90ec5eb65edc97b9683542ea3a18f9c74ed1adfa8d805c930
Instruction ID: 1a277df602ca1877929351888c59ada992c36577b4caeea33bcdf3a170228247
Opcode Fuzzy Hash: 514552dd0099bcf90ec5eb65edc97b9683542ea3a18f9c74ed1adfa8d805c930
Instruction Fuzzy Hash: EFB14A30F106198FDB98DFA9C594A9EB7B6FF88304F248829D4069B355DB35DC86CB81

Function 061E87E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 061E88DB
LR]q, xrefs: 061E892A
$]q, xrefs: 061E8873
$]q, xrefs: 061E8867

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: a4c11c4d19171ea9ae41c165593ddba4e7499aca008889cfb49dbf88110228e1
Instruction ID: 13b71cb5ed5e6ef2bf353a45de3066139070afa59be79366c1340a48a5337e0e
Opcode Fuzzy Hash: a4c11c4d19171ea9ae41c165593ddba4e7499aca008889cfb49dbf88110228e1
Instruction Fuzzy Hash: 3C518330B006059FDB98EF68D590E6E77B6FF88300F148969E8169B3A5DB30EC45CB55

Function 061EACB8 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$]q, xrefs: 061EAE6B
$]q, xrefs: 061EADE9
$]q, xrefs: 061EAE3C
$]q, xrefs: 061EAE94

Memory Dump Source

Source File: 00000000.00000002.3245646222.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e0000_5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_paylo.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 89b40e66b07ba21b4ad01aa6b0f4feb931fb86a66204ade4206fdfd978d4237e
Instruction ID: abcb8038f61715a9b295fbd43197d234d100b6f3fcbb85697c8ad146c54da7a1
Opcode Fuzzy Hash: 89b40e66b07ba21b4ad01aa6b0f4feb931fb86a66204ade4206fdfd978d4237e
Instruction Fuzzy Hash: 3B51CF34E10A048FDF69DB68E590AAEB7B6FF84300F25892AE805D7354DB31DC46CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

Function 061E7D78 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Function 0093E280 Relevance: 2.8, Strings: 2, Instructions: 331
COMMON

Function 061EACC8 Relevance: 12.9, Strings: 10, Instructions: 397
COMMON

Function 061DB228 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200
COMMON

Function 061E9148 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 061ECF30 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Function 061E4B68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 061E9138 Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre