Edit tour

Windows Analysis Report
to.exe

Overview

General Information

Sample name:	to.exe
Analysis ID:	1446064
MD5:	6dc33ba531fce8c8ee24585f48d14297
SHA1:	ebcf11b40ac7087e9390a63968928b2d09e1678d
SHA256:	c450f93d63c121ab42dc4b8978eebe263e53530ef6107a461f68f7f2f2f51cdd
Tags:	exe
Infos:

Detection

CobaltStrike

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

.NET source code contains very large strings

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

to.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\to.exe" MD5: 6DC33BA531FCE8C8EE24585F48D14297)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTP"], "Port": 4545, "SleepTime": 55000, "MaxGetSize": 2098751, "Jitter": 40, "C2Server": "138.68.79.95,/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6", "HttpPostUri": "/messages/IgTsSe2N7hV72H5tmL7bVrTR", "Malleable_C2_Instructions": ["Remove 1190 bytes from the end", "Remove 12 bytes from the end", "Remove 397 bytes from the beginning", "NetBIOS decode 'a'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 96, "Spawnto_x86": "%windir%\\syswow64\\bootcfg.exe", "Spawnto_x64": "%windir%\\sysnative\\bootcfg.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 11629, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["CreateThread", "CreateRemoteThread", "NtQueueApcThread", "RtlCreateUserThread", "ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2913285622.0000000002241000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x137:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x189fd:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d2e:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: to.exe PID: 6576	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: to.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTP"], "Port": 4545, "SleepTime": 55000, "MaxGetSize": 2098751, "Jitter": 40, "C2Server": "138.68.79.95,/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6", "HttpPostUri": "/messages/IgTsSe2N7hV72H5tmL7bVrTR", "Malleable_C2_Instructions": ["Remove 1190 bytes from the end", "Remove 12 bytes from the end", "Remove 397 bytes from the beginning", "NetBIOS decode 'a'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 96, "Spawnto_x86": "%windir%\\syswow64\\bootcfg.exe", "Spawnto_x64": "%windir%\\sysnative\\bootcfg.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 11629, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "Empty"], "ProcInject_Execute": ["CreateThread", "CreateRemoteThread", "NtQueueApcThread", "RtlCreateUserThread", "ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: to.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 72.1% probability

Machine Learning detection for sample

Source: to.exe

Joe Sandbox ML: detected

Source: to.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: to.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 138.68.79.95

Source: unknown

DNS traffic detected: query: 171.39.242.20.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: to.exe, 00000000.00000002.2913963149.000000001B4B4000.00000004.00000020.00020000.00000000.sdmp, to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6
Source: to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6.
Source: to.exe, 00000000.00000002.2913963149.000000001B4B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6Cryptographic
Source: to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6b
Source: to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6h
Source: to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6p

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown

.NET source code contains very large strings

Source: to.exe, Program.cs

Long String: Length: 311752

Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0223C280	0_2_0223C280
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_02226B38	0_2_02226B38
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0223CBF0	0_2_0223CBF0
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0222F1A8	0_2_0222F1A8
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_02230E64	0_2_02230E64
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_02231F9C	0_2_02231F9C
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_02231528	0_2_02231528
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_02270000	0_2_02270000

Source: to.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13

Source: to.exe, Program.cs

Base64 encoded string: 'H4sIAAAAAAAA/6R8eTyU6/s/Y2Tfy3Sqgw4qoibOsVXGvjSGCM1RSBNCmMRkzz7GMiRL2YaypCxhLFnHNiZqUoiOlENJKaM0Zc3vfoY6n893/f1ev3/mVZfnfu77vu739b7e1/Pc9zP5rU9um7q6mBIt6+BYsoefu4NSt29ycX69zlysEqO69ukZ82Tqzuf3e3uEBTDgr4e5V/KLq83Bv1ygn0jw8/rQrq/oHiyme2xKLfGhLTu5okybZfygYo/ox639/heuzE6dnpAtKF5Z3dehelbtnGh72oQQ+rjf+4lHPAr3v+O7/p6P8pk3e7amiVJUn2Ht8V17YiLtuwNzJtC36kW2sYAw7X3Gy89Cu9z2C9xcPG66/KG74fI2j1irTOFShvu0RVjUZ+c1Dc9tCUtfPwvr2HxJPGF8C+9wuOxYzXjFX0uvdzx7KiBn7sfz4py5kpfeR2jMtNJK9B0XT4MLWE9zP9c/XcyPuHImk/DJzM/9GGdaf5tBE/wT/ODM/c5CP+C/Fn4b1zl8svBzd3Ix9191dkH78Z1yMT+74Y2NtuDn8sZ1Fzf+qxOK5dzqiQ3BnR/84ZKjq7n0pv84P7st/NTD//mvi/Zld3v3f/773/7cvOiu/K82m3MOElb/fYsZ2uivpSQHl/5L5zbndowzj3+9LtjFXHKG/hxeOhPngiYDm8dFdwcK+MPps/923Q4Xc7WZgRcSNeB+3J5u4DqCuwMC/MHJ9T9eVzPTvXG/X+2BTeCyu4Mp+IPcf7pObYY+KtDyPs7lRtiGDzj+W/5P1yGnf5+03dkO/5gPr9fT5j6SGNi5s5DdorJoN3O5YGj30Vtaal9MPu4auEcZjoyYpEyfvybahxy8eG36Srt0y7Frib+u5c7GdCo8MW193NKMEUBVPHxztjJRrNQ29eT5fWMiXLpFvygEW7W2kIp+FUIs88Xj3v8lFjv94LrAHq02l11q6/0y6rc7/bvxxwKMWg9dpsBon+7cmsgrkMd8+vWZQCf2jfjKs9HFDzFNOR+ffHi/u+1G43mKWFdg5x6fV5I8YWe8F47Qmy538f9Z7RVp9min0dbbZtw3r1Mpn9c83z0PxR2vlD48aI071xcm+Djw3kkR8Vfcgl4fjZ8W8aU37PGdbNpFvtfxRA0pWznpxrv3bVLDJ2ktw/riNvlh3uXoKLMTendfXRb6lD/6TKapZsxv4lc90308r9+UPI21bt/3d8WEg1n6dskvGsVTjzS6h845HJTvhXxaC7eWtvpQp+rwdyavy4dbuuavyKIM2wHvrUQDe8UOkaITlGYC7bdQoyuiGU70ZiG5wQ4hvfnjjYRjd0v6Yfi/USYYQ/GXzVY18m8amL0gtsTnpIt7OswVJD0jDJwcjapjygkMeOKEO1H7/pW0GqJO+ziylduyjf9SdJasNkE3/+m3RGHcyWAK4/Ue0yWmZ66xVfvOIaao9ftxI2psekAgHH9CWvtiXFahIE9NHvf39SfpPjz4wWp7MuqJfleHiPbDmIW1lmhyvCEJjM/5z7Icrr88JobUdrxun+5MuVsnQJxYRaa96t1RIHvSPjb9mCgjqCQ2EWU3p9QjQsU5qf32el3KcCUlY2wr7XX2rm6eglzKMmkbFnfrsG2WE8bI3iVNEG/BdfCMPy3XCcXvjortpmpkaCX3MnflnZjdWVyJF1px27mm9+DOgE2vicYv9jzw6T22DNsXhdzaz7ztCQvTuFHKgXiVz753e2XUJofYc6UVc7xe2BxNyvS8YAnzATdv4MWyHJgBr0t3rY752/pdtcJBPmTN8bDBDjA+k4WV+PZJ+vfbGEc6G35ukBQXrnNqJX+itLIZnv34eA9Vq7ikopNWkPdtpaeIYLbSu11y8jW5Yeujm9603OY4VM1148UU8fyaNPYcpeIZN+4UshhVEwNs0iW9tHZ7/g4R7ocP44tQNbeBTSaPjPpb/1oHL2m0K7Ap/sBn34XeXcqTRe9Vj7uWwHEXkOXxKidv3cV7Fhr6M85TYHr0w0PI+/tUjlPhvTKwyRhobm3Q3JR4vM4Sf+JqCeDq9S0d8xGyGGE8awfGB8YMklehHxxGxsWrXBYU9jai8tm3Z0sw2k/nXF1efyJ7G72SElpOp7bObX1YRymSIB9EFFUKCl8woqIbWRM71mZrdiNCI3cTjKjacN8d6AKWp2sCM4krf2m1O4vVtRIhj3kA+3pO0isqifv6ZzbXrYrsWmF7R2P7qL1/JlOFz7wwCSK8Pm6E6fakHKxBXrQRPOd3R7rdKPLgXN0X7WeFxrbQdfXgOiNd1PmxmTaqiWp2s5BTGsGIf9CKgX8ssXZMPLkkCXNJo0rSJ4pXyf9+g9It1bvdSQ67LO4lT6vV9/bMvDzk92l6j9ByX2Vy3X1d4guzc1Z3rvEGf7a4+5mekuFEPMJ2T7OiWw4Pa9V3T59Hr/S3XWf7L3542iEi8TB9YY0a3caDX6g2SUA90F84diyyYNtbGwZr795XlPGRmtRitR94ju82FcU7jQ7LoPCq2BCf8z25zcY7f/PRvdUr89vki6W5rIppbpzHV1kNRCV6pWs7rh5335UCF+iZyW3WRAe8pSEfegoupgMMVfbQy29WrbMOvLMKt5o1J2t/9s65ebG3PM2QxHOwigduWcndycDYS0Hje7GwVh49zYNfqRYlawYZpz3rlWpwvtwUr+LJ4zeSJ231ogKseT5Y8xzN9OlFwfJe6ZqvqxpJabAUOM54eQ3JUqyW+nLfiX4ozNPeJQ4zM45EdSuzqIGX31vru7e6DjbZCuNOWxBjVHyYShHiFICDa5IJJMbx3GYCqbuKj3AHFd9JZQtLaYO2T5G/TfROMZVWEhHoP/5wHSQx6aghZDNJwdewdsuT4Gm2QYOOCLjuFwys4b28zkKL6ZhYX6ES1uIxfc9Aal2kyntDHuGTDt/q2DPZya0yHybsdW8VTdID+QCXrGrUZMPMeCNPCxFopR+oVVWtY1s6iPbc94bNMyO+rfHNKcY

Source: classification engine

Classification label: mal96.troj.winEXE@2/0@1/0

Source: C:\Users\user\Desktop\to.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03

Source: to.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: to.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\to.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: to.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\to.exe "C:\Users\user\Desktop\to.exe"
Source: C:\Users\user\Desktop\to.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\to.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\to.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: to.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: to.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0221935D push edi; iretd	0_2_0221935E
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0223A86F push ebp; iretd	0_2_0223A870
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0223A84F push ebp; iretd	0_2_0223A850
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0223A898 push ebp; iretd	0_2_0223A899
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0221F901 push ebx; iretd	0_2_0221F902
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0221B91C pushad ; retf	0_2_0221B91D
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0221971E push cs; retf	0_2_0221971F
Source: C:\Users\user\Desktop\to.exe	Code function: 0_2_0221AD58 push ebp; iretd	0_2_0221AD59

Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\to.exe	Memory allocated: B60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Memory allocated: 1A3C0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -44076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -97516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -37895s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -40528s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -51729s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -39072s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -47028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -39187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -34918s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -42263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -50718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36384s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48486s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -53331s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -43197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -45842s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -45788s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -47676s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -52687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -46553s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -44785s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -50280s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -35766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -45780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -53571s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -46648s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -46734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36246s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -46581s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -45121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -37676s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -47603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -34426s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -38749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -50313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36712s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -52133s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49229s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -34541s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -38765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -36682s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -54025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -49744s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -47207s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -33947s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -53334s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -53431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48623s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -33521s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -52493s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -50653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\to.exe TID: 6608	Thread sleep time: -38973s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 44076	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48758	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 37895	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 40528	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 51729	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 39072	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 47028	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 39187	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 34918	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 42263	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 50718	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36384	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48486	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36856	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 53331	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48704	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 43197	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36423	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 45842	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 45788	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 47676	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 52687	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48750	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 46553	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 44785	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49484	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 50280	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 35766	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 45780	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 53571	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 46648	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49639	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 46734	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36246	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 46581	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36062	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 45121	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 37676	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 47603	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 34426	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 38749	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 50313	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36712	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 52133	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49229	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 34541	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 38765	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49515	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49014	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 36682	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48169	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48106	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 54025	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 49744	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 47207	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 33947	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 53334	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 53431	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48623	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 33521	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 52493	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 50653	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 48000	Jump to behavior
Source: C:\Users\user\Desktop\to.exe	Thread delayed: delay time: 38973	Jump to behavior

Source: to.exe, 00000000.00000002.2913963149.000000001B4B4000.00000004.00000020.00020000.00000000.sdmp, to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\to.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\to.exe

Queries volume information: C:\Users\user\Desktop\to.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\to.exe

Code function: 0_2_02224E28 GetUserNameA,strrchr,_snprintf,

0_2_02224E28

Source: C:\Users\user\Desktop\to.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.2913285622.0000000002241000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: to.exe PID: 6576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
to.exe	37%	ReversingLabs
to.exe	100%	Avira	HEUR/AGEN.1305446
to.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6h	0%	Avira URL Cloud	safe
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6.	0%	Avira URL Cloud	safe
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6	0%	Avira URL Cloud	safe
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6Cryptographic	0%	Avira URL Cloud	safe
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6p	0%	Avira URL Cloud	safe
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6b	0%	Avira URL Cloud	safe
138.68.79.95	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
171.39.242.20.in-addr.arpa	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
138.68.79.95	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6h	to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6	to.exe, 00000000.00000002.2913963149.000000001B4B4000.00000004.00000020.00020000.00000000.sdmp, to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6p	to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6b	to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6Cryptographic	to.exe, 00000000.00000002.2913963149.000000001B4B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://138.68.79.95:4545/messages/EUZe0uldTA2AbkYWRhTDDfV6zreju6.	to.exe, 00000000.00000002.2912546253.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446064
Start date and time:	2024-05-22 22:07:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	to.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/0@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 138.68.79.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: to.exe

Simulations

Behavior and APIs

Time	Type	Description
16:07:57	API Interceptor	65x Sleep call for process: to.exe modified

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.013345678436382
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	to.exe
File size:	628'736 bytes
MD5:	6dc33ba531fce8c8ee24585f48d14297
SHA1:	ebcf11b40ac7087e9390a63968928b2d09e1678d
SHA256:	c450f93d63c121ab42dc4b8978eebe263e53530ef6107a461f68f7f2f2f51cdd
SHA512:	610c85c99f931ea5fdebb31743bea9f902eee5bb27a8c3708266018116079afeaf2b56f3fed99ed8513b619ae8b34458536234a5875db4cf0e7bcabefce96542
SSDEEP:	12288:GAZs5aKLy6Xnud0CeCWchG5KLJ4QG/y/sp0OwwyQm1AMCZWMqw5OD:eXr/p0iyh1A
TLSH:	AED439342DEA602AB173EF698BE475DADA5FB7633B03585D10A1038A0723D42EED153D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O>f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49ad2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x663E4FDF [Fri May 10 16:48:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9acd8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c000	0x4c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x98d34	0x98e00	23d75d1886dcd8ca2846d68859b74184	False	0.480210036794767	data	4.012370674858687	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9c000	0x4c8	0x600	4849b375f65ccb47316f0f1e1e917f13	False	0.37109375	data	3.6782600390338445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9e000	0xc	0x200	9894ec3063af32abda01354b264192bf	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9c0a0	0x234	data			0.4645390070921986
RT_MANIFEST	0x9c2d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 22:08:28.121212006 CEST	53	56434	162.159.36.2	192.168.2.4
May 22, 2024 22:08:28.843261003 CEST	56311	53	192.168.2.4	1.1.1.1
May 22, 2024 22:08:29.152483940 CEST	53	56311	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 22:08:28.843261003 CEST	192.168.2.4	1.1.1.1	0x408d	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 22:08:29.152483940 CEST	1.1.1.1	192.168.2.4	0x408d	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	16:07:52
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\to.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\to.exe"
Imagebase:	0x100000
File size:	628'736 bytes
MD5 hash:	6DC33BA531FCE8C8EE24585F48D14297
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2913285622.0000000002241000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2913495283.0000000012513000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:07:52
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.8%
Total number of Nodes:	954
Total number of Limit Nodes:	59

Executed Functions

Function 02224E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02224FEC: malloc.LIBCMT ref: 02225008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,0221BC89), ref: 02224EAF
strrchr.LIBCMT ref: 02224EED
_snprintf.LIBCMT ref: 02224F9B

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 68b8d0cca34df3a831357e04e30cd39368f1f21b79bd8b0e97628ed75d1b1ace
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 4B41B430728B184FEB48FBACA455A7972C3EBDC310B50852DE48FC3259DE78D8068B42

Function 02270000 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 022700D0

Memory Dump Source

Source File: 00000000.00000002.2913371456.0000000002270000.00000020.00001000.00020000.00000000.sdmp, Offset: 02270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2270000_to.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction ID: 48fc0ac70100d0ac2b199203b594c686d312b4dabb0ffee1dae98ba9c0ea8ce9
Opcode Fuzzy Hash: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction Fuzzy Hash: 93513834228A468F871DCE5C95C1A36B7D5F785309315A6BDD59BCB26BCA30D846CB80

Function 0221E014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0221E118: WSAStartup.WS2_32 ref: 0221E136

WSASocketA.WS2_32 ref: 0221E042
WSAIoctl.WS2_32 ref: 0221E08F
closesocket.WS2_32 ref: 0221E0EE

Strings

_Cy, xrefs: 0221E0A1

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: IoctlSocketStartupclosesocket
String ID: _Cy
API String ID: 365704328-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 5541d66587f26a4dc64919723272badc4c64870f7d166aab9870fd534e5ac884
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: E131C53062CE494BDB64EF689884B66B7E1FBA8315F21463EEC8ED3255DB34C5428741

Function 0221D68C Relevance: 6.3, APIs: 4, Instructions: 260
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0221D725

Part of subcall function 0222E63C: _errno.LIBCMT ref: 0222E673
Part of subcall function 0222E63C: _invalid_parameter_noinfo.LIBCMT ref: 0222E67E

_snprintf.LIBCMT ref: 0221D7BD
InternetCloseHandle.WININET ref: 0221D898

Part of subcall function 02221D70: strchr.LIBCMT ref: 02221DD6
Part of subcall function 02221D70: _snprintf.LIBCMT ref: 02221E0C

Part of subcall function 02221C0C: strchr.LIBCMT ref: 02221C69
Part of subcall function 02221C0C: _snprintf.LIBCMT ref: 02221CB3

_snprintf.LIBCMT ref: 0221D7D4

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$CloseHandleInternet_errno_invalid_parameter_noinfo
String ID:
API String ID: 1147558511-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: fed2ef2ef196a0d5a3842796d1439d3c1f91c076be8a54e8e66301a34995d229
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: 35810A31628B588FDB18EF68D884ABAB3E6FB94711F40052EE48AC7155DF34D906CB81

Function 0221DA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0221DB0C
InternetConnectA.WININET ref: 0221DB7A

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction ID: 0690cd86c5d7da7a7cb16b5ea1639a82a91ea0876ed37b2577a642febce88759
Opcode Fuzzy Hash: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction Fuzzy Hash: 99419B30628B148FDB49EFA8D895729B3D6FB98304F51042DD48BC36A5DB7CD906CB86

Function 0222C3B8 Relevance: 1.6, APIs: 1, Instructions: 122
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 0222C49E

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aac624e9975941b750356ceb78cd3aa232c6bd2fb96b7d29432793f1a6c54ced
Instruction ID: 24e70d738faef9d629b2c88ae1bfe11c709866ebdd60ecfd519c317ffedebf6e
Opcode Fuzzy Hash: aac624e9975941b750356ceb78cd3aa232c6bd2fb96b7d29432793f1a6c54ced
Instruction Fuzzy Hash: 1831803062CB598F9B58DF9CA89563A37E5FB98310B51012FE44AC3329DB75E845CB82

Function 0221E118 Relevance: 1.6, APIs: 1, Instructions: 50
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0221E136

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: df88eb95308a54b3e1dd63d5abd955df02cfb1df72e04a0c2f97fe2a777c2e26
Instruction ID: 430f44bd0f9583270b0f910311b7962a3acdb26a6f9a25ef801d1ca39025bf09
Opcode Fuzzy Hash: df88eb95308a54b3e1dd63d5abd955df02cfb1df72e04a0c2f97fe2a777c2e26
Instruction Fuzzy Hash: 0C0161B07207499BFB19ABE0E85C76436A6FB55304FC00439AA55CB2A5DB7E860CCF01

Function 00007FFD9B880A75 Relevance: 1.5, APIs: 1, Instructions: 236
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9B880BE7

Memory Dump Source

Source File: 00000000.00000002.2914203103.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_to.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4f6b64b2b175abfda5f080dac6f944c937640d41828d416fe148bc2b69b8be54
Instruction ID: 39ae6450118c73416b6e3903a766deaf4183506a9cb26b8bbe64b1a374ab7587
Opcode Fuzzy Hash: 4f6b64b2b175abfda5f080dac6f944c937640d41828d416fe148bc2b69b8be54
Instruction Fuzzy Hash: 5C516D31B0DB890FD7199778A8666F57BE0EF49321F1501BFE09DC31A3DA2869438381

Function 0222C1C8 Relevance: 1.4, APIs: 1, Instructions: 121
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0222C2B0

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aae31d7e320f49b2b7b8d2523f04f5552282cf255c9fc24f679e558ee007d563
Instruction ID: f40713bf7e3ba4364ffeb61a1c5d1dcc28801df26be3efd92295d2a0b7f8b7a4
Opcode Fuzzy Hash: aae31d7e320f49b2b7b8d2523f04f5552282cf255c9fc24f679e558ee007d563
Instruction Fuzzy Hash: 0531923062CB599F9B59DF9CA89162A77E1F79C700B11062FE449C3324DBB5E805CB82

Function 0222C2EC Relevance: 1.3, APIs: 1, Instructions: 75
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 0222C3A2

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 33013136f0bb95f1eb9f3645b418df4a5ff2efb559231014e174e8ee2656166c
Instruction ID: 546bef70ce4adaf66a831cb19a4b0f01a91ee29cc976f1ff6f5a7a19006057ca
Opcode Fuzzy Hash: 33013136f0bb95f1eb9f3645b418df4a5ff2efb559231014e174e8ee2656166c
Instruction Fuzzy Hash: FD21C030628B588FDB54DB9CE44872D37E5F79C301F010D2ED449C7224CB799888CB85

Non-executed Functions

Function 02231F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 02230600: _getptd.LIBCMT ref: 02230616
Part of subcall function 02230600: __updatetlocinfo.LIBCMT ref: 0223064B
Part of subcall function 02230600: __updatetmbcinfo.LIBCMT ref: 02230672

_errno.LIBCMT ref: 02232002

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_fileno.LIBCMT ref: 0223202F

Part of subcall function 02234A54: _errno.LIBCMT ref: 02234A5D
Part of subcall function 02234A54: _invalid_parameter_noinfo.LIBCMT ref: 02234A68

write_multi_char.LIBCMT ref: 0223266B
write_string.LIBCMT ref: 02232688
write_multi_char.LIBCMT ref: 022326A5
write_string.LIBCMT ref: 02232704
write_multi_char.LIBCMT ref: 0223275D
free.LIBCMT ref: 02232771
_isleadbyte_l.LIBCMT ref: 02232842
write_char.LIBCMT ref: 02232858
write_char.LIBCMT ref: 02232879
_errno.LIBCMT ref: 0223297C
_invalid_parameter_noinfo.LIBCMT ref: 02232987

Strings

@, xrefs: 0223201B
, xrefs: 0223263F

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: 0fbc2a8cc0707f78ef0993cdd2236c90b040dff158ae193548d4bffd8a813084
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: 6F5229B1938B4ACADB2E8A9CC8553B9B7E1FB95314F24432DDD87C3159DB74DC028A42

Function 02231528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02230600: _getptd.LIBCMT ref: 02230616
Part of subcall function 02230600: __updatetlocinfo.LIBCMT ref: 0223064B
Part of subcall function 02230600: __updatetmbcinfo.LIBCMT ref: 02230672

_errno.LIBCMT ref: 0223158E

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_fileno.LIBCMT ref: 022315BB

Part of subcall function 02234A54: _errno.LIBCMT ref: 02234A5D
Part of subcall function 02234A54: _invalid_parameter_noinfo.LIBCMT ref: 02234A68

write_multi_char.LIBCMT ref: 02231BEB
write_string.LIBCMT ref: 02231C08
write_multi_char.LIBCMT ref: 02231C25
write_string.LIBCMT ref: 02231C84
write_multi_char.LIBCMT ref: 02231CDD
free.LIBCMT ref: 02231CF1
_isleadbyte_l.LIBCMT ref: 02231DC2
write_char.LIBCMT ref: 02231DD8
write_char.LIBCMT ref: 02231DF9
_errno.LIBCMT ref: 02231EF3
_invalid_parameter_noinfo.LIBCMT ref: 02231EFE

Strings

, xrefs: 02231BBF

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: a6915c4793641a82d023eeccce7412511aa518079f8f39f3daa4acb30df80709
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: AB522BB0938B4A8AD72E8ADCC8513B9B7E1FB96314F14462DD88FC3159DB75D812C742

Function 02226B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 02226CA5
_snprintf.LIBCMT ref: 02226D66
_snprintf.LIBCMT ref: 02226D83
_snprintf.LIBCMT ref: 02226FD8
_snprintf.LIBCMT ref: 022270E8
_snprintf.LIBCMT ref: 022271A6
_snprintf.LIBCMT ref: 0222725E
_snprintf.LIBCMT ref: 02227002

Part of subcall function 0222E63C: _errno.LIBCMT ref: 0222E673
Part of subcall function 0222E63C: _invalid_parameter_noinfo.LIBCMT ref: 0222E67E

_snprintf.LIBCMT ref: 02227276
_snprintf.LIBCMT ref: 02227334

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: ae993b1b208ef0e28b095c301210422eb4a15b1be53d6270964285ce789e5709
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: EF52D13052CE99ABE71EAB6CD4426F0F3E1FFA8309F405218D985C7525EB35E58AC781

Function 0222F1A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 0222F1DC

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: 7628f671c13fcb3b4f9be8bc21ffab7c7a2afc14210af46ef2431b7c771bfa88
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: 7FA1CC71619A09CFEF95FFB5E8989AA37B2F768301321893A904AC3174DABCD545CF40

Function 0223CBF0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 5dfbd5608844e426112561b239b0f35d059f0cb3b4fa8af22d1060a88d628447
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 22520A312286558FD31CCB1CC4B1B7AB7E1FB89340F44896DE287CB696C639DA45CB91

Function 0223C280 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: 979c8ff8fce483180b26710dcdfd31d27258d753c715599aed36c6b6ed079e9b
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 9152EE312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639D645CB91

Function 02235E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02235E4E

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 02235E45

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

__doserrno.LIBCMT ref: 02235EAB
_errno.LIBCMT ref: 02235EB2
_invalid_parameter_noinfo.LIBCMT ref: 02235F16

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: 6747f955140acb0e03513226f4155ec4ad0858e8a850856ca7720cc9066e14e3
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: 683138F02387094FD35BAFE8888113D36D1EF4B320B910659D45ACB2A9DB74AD028BA1

Function 02236C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02236C33

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 02236C2B

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

__lock_fhandle.LIBCMT ref: 02236C77
_lseeki64_nolock.LIBCMT ref: 02236C90
_unlock_fhandle.LIBCMT ref: 02236CB3

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: bde2ee74152a614af365767c699ab9115b9f1a27a0399a48511047f7ecba052e
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: 39216AB0638B051FE34BABDCD84537D72D9FF86321F450A4DD01AC7299CBA46C428AA6

Function 02236A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02236ABB

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 02236AB3

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

__lock_fhandle.LIBCMT ref: 02236AFF
_lseek_nolock.LIBCMT ref: 02236B18
_unlock_fhandle.LIBCMT ref: 02236B39

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: ad05752699fad58a6eace6e7326458a75602b61a789615d881350229d5b701af
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 802167B07387044FD31B6FE8D8413BC76DAEF82330F15065CD05687299DBB45C028AAA

Function 02235434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0223545F

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 02235457

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

__lock_fhandle.LIBCMT ref: 022354A3
_unlock_fhandle.LIBCMT ref: 022354DD

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: 39d8206000f1668a4501013adf2d6e5a17df49aa755b0743a756e01de3d3948f
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: ED2148B162C7044FD35EAFA8D88137D36C2EF8A332F55064DD11A87299DAA45C128AA2

Function 02234C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02234C79

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 02234C71

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

__lock_fhandle.LIBCMT ref: 02234CBD
_close_nolock.LIBCMT ref: 02234CD0
_unlock_fhandle.LIBCMT ref: 02234CE9

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: 9d73efa2eb2c1510abc90510530f77f0a7af2cb7d4f47d28d230c41c81e3b328
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: 491138B1139B084FD35BBFE9C88036876D1FF46321F250A9DE41A872D9CAB99841CB71

Function 0222EF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0222EF9A

Part of subcall function 0222E244: RtlDeleteBoundaryDescriptor.NTDLL ref: 0222E25A
Part of subcall function 0222E244: _errno.LIBCMT ref: 0222E264

free.LIBCMT ref: 0222EFAF
free.LIBCMT ref: 0222EFD0
free.LIBCMT ref: 0222EFE5
free.LIBCMT ref: 0222EFF9
free.LIBCMT ref: 0222F005
free.LIBCMT ref: 0222F030
free.LIBCMT ref: 0222F051
free.LIBCMT ref: 0222F06A
free.LIBCMT ref: 0222F09B

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: free$BoundaryDeleteDescriptor_errno
String ID:
API String ID: 3555341564-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: bc30a058d0c3d4ff0cc199ae59f7b23c8ed1e791ffd37284d0699366af65d5d1
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 7131C230274E1B9FFB64EBD8E894B6872E1FB58315F6540698006C22A8CF7DA949DB11

Function 0221360C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 022136A9

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

malloc.LIBCMT ref: 022136B3

Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E318
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E31D

malloc.LIBCMT ref: 022136BE
free.LIBCMT ref: 0221387E
free.LIBCMT ref: 02213886
free.LIBCMT ref: 0221388E

Part of subcall function 022144F0: malloc.LIBCMT ref: 0221453A
Part of subcall function 022144F0: malloc.LIBCMT ref: 02214545
Part of subcall function 022144F0: free.LIBCMT ref: 0221462C
Part of subcall function 022144F0: free.LIBCMT ref: 02214634

free.LIBCMT ref: 0221389A
free.LIBCMT ref: 022138A7
free.LIBCMT ref: 022138B4

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh$AllocateHeap
String ID:
API String ID: 2779598320-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: 130d36fd4e866d7a54ec527900f94d817259405ce2c453d3d10c06eaa7eea6f7
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: AD81EB70738B4D4BC729EFAC9441B7A73D3EB95704F55029ED48BC3249EF60D8068686

Function 0222EE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0222EE36

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_invalid_parameter_noinfo.LIBCMT ref: 0222EE42
__crtIsPackagedApp.LIBCMT ref: 0222EE53
_dosmaperr.LIBCMT ref: 0222EE9D

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: 46849d99b63f7668092eb2271b40356f89546a7294963ebbbfe25c8a0795aa8c
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: 32312530734B1A9FDB48EFB8984436976D1FF88320F15426DE40AC33A8DB79D8458B42

Function 0223973C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02239755

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__lock_fhandle.LIBCMT ref: 0223979D
__doserrno.LIBCMT ref: 022397D2
_errno.LIBCMT ref: 022397D9
_unlock_fhandle.LIBCMT ref: 022397E9

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: e3dfbe17278d9347f44c04e2592c5bae5c59c9d505f47c818eb6454ed719dd37
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: 792135F0638B054FD717AFE898D03AD7691EF87310B450A1CE11B8B2D9D7E858818BA1

Function 0222FB10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0222FB4C

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_invalid_parameter_noinfo.LIBCMT ref: 0222FB57
memcpy_s.LIBCMT ref: 0222FC1C
_fileno.LIBCMT ref: 0222FC87
_filbuf.LIBCMT ref: 0222FCB5
_errno.LIBCMT ref: 0222FD05

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 3368c13348a2d92310d1ec84cb8a28bd2740b923d6e90249125cf521afed9a91
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 91517F3033CF2A1B972C9AAC555513573E2FBD8724B14032EE856C3A9DEF62D85A86C1

Function 0222F620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0222F577

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_invalid_parameter_noinfo.LIBCMT ref: 0222F582
_getstream.LIBCMT ref: 0222F5A2
_errno.LIBCMT ref: 0222F5B4
_errno.LIBCMT ref: 0222F5C6
_openfile.LIBCMT ref: 0222F5F4

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: fbd773bf6b2715730a3dd7f46a22e3227101b1267ffb08a50070f3071828aee6
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: B92101B0638B5E5FE7A5EFA8940432A72E2FF89310F44096A9449C3228EF75CC418791

Function 022221F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0222222E
strchr.LIBCMT ref: 0222224C
malloc.LIBCMT ref: 02222264
malloc.LIBCMT ref: 02222271
rand.LIBCMT ref: 0222233D
free.LIBCMT ref: 0222245B
free.LIBCMT ref: 02222463

Part of subcall function 0222E244: RtlDeleteBoundaryDescriptor.NTDLL ref: 0222E25A
Part of subcall function 0222E244: _errno.LIBCMT ref: 0222E264

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$BoundaryDeleteDescriptor_errnorand
String ID:
API String ID: 4223773762-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: ed9b02933b0d91bbc734b1f77b78c1e8d3c281da4dd5b255b48232a579001f1a
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: 91711920638FA99BDB69EB6C94003F6B3D1FF89309F04026DD98AC7159DE36954BC781

Function 02213170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 022131BD

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

malloc.LIBCMT ref: 022131C8

Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E318
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E31D

free.LIBCMT ref: 022132AF
free.LIBCMT ref: 022132B7
free.LIBCMT ref: 022132BF
free.LIBCMT ref: 022132CB
free.LIBCMT ref: 022132D8

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocateHeap
String ID:
API String ID: 4095668141-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: bece0d05f92ee5770cbd757d59dfcc85d6634015e941fa0444ca74363bae7e8b
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: 8A41F530728F5A5F975DEBAC9441A7A77D2FB5930475002ADD84BC320AEFA0EC028BC5

Function 0221BA74 Relevance: 7.9, APIs: 6, Instructions: 411COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02224FEC: malloc.LIBCMT ref: 02225008

malloc.LIBCMT ref: 0221BB3B

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

Part of subcall function 0222B230: malloc.LIBCMT ref: 0222B29C

Part of subcall function 0222DAA8: malloc.LIBCMT ref: 0222DAF8

Part of subcall function 0222DAA8: realloc.LIBCMT ref: 0222DB07

malloc.LIBCMT ref: 0221BC4A
_snprintf.LIBCMT ref: 0221BCC1
_snprintf.LIBCMT ref: 0221BCE7
_snprintf.LIBCMT ref: 0221BD0E
free.LIBCMT ref: 0221BEC6

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$AllocateHeap_callnewhfreerealloc
String ID:
API String ID: 705544021-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: cb36d720ce67fea3219bef792454d813172670f7cb0563c71c14337cb987ed18
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: 8CC1E630734B155BDB18FBF88855A7DB2E3EB94304F90052D9847C7699DE39D90A8B82

Function 02220694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 02224FEC: malloc.LIBCMT ref: 02225008

Part of subcall function 0222F620: _errno.LIBCMT ref: 0222F577
Part of subcall function 0222F620: _invalid_parameter_noinfo.LIBCMT ref: 0222F582

fseek.LIBCMT ref: 02220730

Part of subcall function 0222FEA4: _errno.LIBCMT ref: 0222FECC
Part of subcall function 0222FEA4: _invalid_parameter_noinfo.LIBCMT ref: 0222FED7

_ftelli64.LIBCMT ref: 02220738

Part of subcall function 0222FF18: _errno.LIBCMT ref: 0222FF36
Part of subcall function 0222FF18: _invalid_parameter_noinfo.LIBCMT ref: 0222FF41

fseek.LIBCMT ref: 02220748

Part of subcall function 0222FEA4: _fseek_nolock.LIBCMT ref: 0222FEF5

malloc.LIBCMT ref: 02220788

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

fclose.LIBCMT ref: 02220845

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$AllocateHeap_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 495604859-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: 145b7b02f15b03ad613e60a525888f4976f9b8df52c8ee3cd70a1d17f695a862
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: B751C831738B584FC74DEBACD455A7A72D2FB98310B90426ED44FC3299DE649D068BC2

Function 02239348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 02239375

Part of subcall function 02232E58: _FF_MSGBANNER.LIBCMT ref: 02232E75
Part of subcall function 02232E58: _NMSG_WRITE.LIBCMT ref: 02232E7F

_lock.LIBCMT ref: 02239388
_lock.LIBCMT ref: 022393E3
_calloc_crt.LIBCMT ref: 0223949A

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: 776e9e8a86ba9f17cf601c9573c744a10f8411a152490af9fea24410a197751f
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: CE5128B1538B098FDB19DF98C881266B7E0FB59314F11425DD88AC7269DBB4D882CBC2

Function 022144F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0221453A

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

malloc.LIBCMT ref: 02214545

Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E318
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E31D

free.LIBCMT ref: 0221462C
free.LIBCMT ref: 02214634
free.LIBCMT ref: 02214640
free.LIBCMT ref: 0221464D

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocateHeap
String ID:
API String ID: 4095668141-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: 4379df0832dac1cb8b73e3ec789ae7d6a748c60668649c160d7854d5008cab2e
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: 6C412B31328B5E4B9B19FBAC4845A7A77D5EBE6359B14422DD88BC3216EE20D807C7C1

Function 0223139C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 022313B9

Part of subcall function 02234A54: _errno.LIBCMT ref: 02234A5D
Part of subcall function 02234A54: _invalid_parameter_noinfo.LIBCMT ref: 02234A68

_errno.LIBCMT ref: 022313C9

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_errno.LIBCMT ref: 022313E5
_isatty.LIBCMT ref: 02231446
_getbuf.LIBCMT ref: 02231452

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: b4d85f3382dba86ddcf059db80a303cd179a3e27dee15b3671505dd616ea2a20
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: E141E4B0234B098FCB5AEFA8C48176577E1FF48320B540699D95ECB29ED774C861CB81

Function 02228220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0222824F

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

_snprintf.LIBCMT ref: 02228267

Part of subcall function 0222E63C: _errno.LIBCMT ref: 0222E673
Part of subcall function 0222E63C: _invalid_parameter_noinfo.LIBCMT ref: 0222E67E

free.LIBCMT ref: 0222827E

Part of subcall function 0222E244: RtlDeleteBoundaryDescriptor.NTDLL ref: 0222E25A
Part of subcall function 0222E244: _errno.LIBCMT ref: 0222E264

malloc.LIBCMT ref: 022282CE
_snprintf.LIBCMT ref: 022282E6
free.LIBCMT ref: 0222830E

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$AllocateBoundaryDeleteDescriptorHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 383335425-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: 04808a64986203972fc94a66b4bbb56ecd70008fd81f1f26329a117bccaba058
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: 2731F82032CEAC1FD75CABAC68113B877D3E789310745429DD08FC325ADE65EC468B96

Function 0221EC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0221EC85

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

free.LIBCMT ref: 0221ECC0
fwrite.LIBCMT ref: 0221ED01
fclose.LIBCMT ref: 0221ED09
free.LIBCMT ref: 0221ED16

Part of subcall function 0222E244: RtlDeleteBoundaryDescriptor.NTDLL ref: 0222E25A
Part of subcall function 0222E244: _errno.LIBCMT ref: 0222E264

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno$free$AllocateBoundaryDeleteDescriptorHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 1599808278-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: b69ea2c1f1cf75eb705ef1627b2d10bbc0ca57bf616ba94454fbd6af0b7bb0c1
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: 5821A420238F1D5FC789FBAC845476EB2D2FB9C340F90066DA44AC3298ED65D9058B82

Function 022395EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 022395FD

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

__doserrno.LIBCMT ref: 022395F5

Part of subcall function 02230CA8: _getptd_noexit.LIBCMT ref: 02230CAC

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: d153a5e4ef6465070a07428c91697433ece760b0174c38535c803d09ac75bb1e
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: 2EF0C8B0136A894FE79BA7F4C8903543291FF06325F944254D015C71FCDBBC54858F22

Function 0221DC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0221DCD3
_snprintf.LIBCMT ref: 0221DCFE
_snprintf.LIBCMT ref: 0221DD1A
_snprintf.LIBCMT ref: 0221DDCF
_snprintf.LIBCMT ref: 0221DDE6

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: b2260b6955ed756888dd9dbf28199f82cf559d67c9b245f1fb9eec58770b7ee2
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: FD81E931628B488FDB54FF68DC84BAA73E6FBA9304F000569D44AC3155DF38D945CB42

Function 0222DFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0222E00F

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

malloc.LIBCMT ref: 0222E01D

Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E318
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E31D

malloc.LIBCMT ref: 0222E03F
_snprintf.LIBCMT ref: 0222E05A

Part of subcall function 0222E63C: _errno.LIBCMT ref: 0222E673
Part of subcall function 0222E63C: _invalid_parameter_noinfo.LIBCMT ref: 0222E67E

malloc.LIBCMT ref: 0222E075

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$AllocateHeap_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 3487649172-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: 31bfc5bef6e76264e60a56785afdb27477abc26e085725c200c4ed302876b875
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: 9D11C430A2CF181FD7A8EF6CA04422576D2FB8C310F51465EE09EC3399EA34AC454BC1

Function 0222F62C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0222F664

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_invalid_parameter_noinfo.LIBCMT ref: 0222F66F
_flush.LIBCMT ref: 0222F721
_fileno.LIBCMT ref: 0222F742

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: 169f402da865fafb2f87886b42cc551de449626e4af7dcbf14ac45c45db7f103
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: 5B418F30338F1E5FC72C6EED564527572E1EB58310B10026ED49AC397EEBA2D85A86C2

Function 022100D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 02210117
clock.LIBCMT ref: 02210124
clock.LIBCMT ref: 0221012D
clock.LIBCMT ref: 0221013A

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 4d6242bedcc69bcab5bcc7e386b0b6bbf93bc32180e259b44ba235aaf91284c4
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 7711207141C70D4F8728ADE85442736B7D0E799250F15062EECCAC3116FAA49D8286D6

Function 02210CC4 Relevance: 5.4, APIs: 4, Instructions: 410COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 02210D6A

Part of subcall function 0223DE08: _calloc_impl.LIBCMT ref: 0223DE18
Part of subcall function 0223DE08: _errno.LIBCMT ref: 0223DE2B
Part of subcall function 0223DE08: _errno.LIBCMT ref: 0223DE35

free.LIBCMT ref: 02210EF3
free.LIBCMT ref: 02210EFD

Part of subcall function 0222E244: RtlDeleteBoundaryDescriptor.NTDLL ref: 0222E25A
Part of subcall function 0222E244: _errno.LIBCMT ref: 0222E264

free.LIBCMT ref: 02210F0F

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errnofree$BoundaryDeleteDescriptor_calloc_implcalloc
String ID:
API String ID: 3013916351-0
Opcode ID: d93992b633c35f2e37b516dd72fb4d9a33d59668b61f8d19e3ffcf9038676577
Instruction ID: 00ac9a5124a520b33f3c1ecc9e9f60d8eec297f0de5ea67fed7b39e05b71874d
Opcode Fuzzy Hash: d93992b633c35f2e37b516dd72fb4d9a33d59668b61f8d19e3ffcf9038676577
Instruction Fuzzy Hash: 55D15E70A18B498FDB58DF5CD484BAABBE1FBA8305F10452EE88DC3255DB70D945CB42

Function 0222E860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0222E8B1

Part of subcall function 02230D18: _getptd_noexit.LIBCMT ref: 02230D1C

_invalid_parameter_noinfo.LIBCMT ref: 0222E8BC

Strings

B, xrefs: 0222E8E8

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: d852b2c6f777951cc42b47776725197dc90e2b9390a68993e570115d34051255
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: BF118F30628B084FD744EF589485765B7D1FB98324F5047AEA459C72A4DF74D944CB82

Function 02229D44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 02229D78

Part of subcall function 0222E284: _FF_MSGBANNER.LIBCMT ref: 0222E2B4
Part of subcall function 0222E284: _NMSG_WRITE.LIBCMT ref: 0222E2BE
Part of subcall function 0222E284: RtlAllocateHeap.NTDLL ref: 0222E2D9
Part of subcall function 0222E284: _callnewh.LIBCMT ref: 0222E2F2
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E2FD
Part of subcall function 0222E284: _errno.LIBCMT ref: 0222E308

free.LIBCMT ref: 02229EBF
free.LIBCMT ref: 02229F23
free.LIBCMT ref: 02229F2F

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocateHeap_callnewhmalloc
String ID:
API String ID: 106865790-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: 8e2910473e7c20af5f7add405975b394663b1065634ef3d0b96e6ab542b41a1d
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: 6551E730338B295BDB58EBA8D49067D73E2FB88300F600A2DD54BC325DDF76D54A8A85

Function 02213300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 02213363

Memory Dump Source

Source File: 00000000.00000002.2913255827.0000000002210000.00000020.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2210000_to.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: 83cef668ca86e99ad0c68a22160229a980d6218f74b28d9acc7f7a78f7980f84
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: 0A41E47062CB054BCB1DDFACD481A7A73E2FB9931074445ADD88BC324AEF30E8468A85

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report to.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
to.exe

Function 02224E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 02270000 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Function 0221E014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 0221D68C Relevance: 6.3, APIs: 4, Instructions: 260
networkCOMMONLIBRARYCODE

Function 0221DA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Function 0222C3B8 Relevance: 1.6, APIs: 1, Instructions: 122
memoryCOMMONLIBRARYCODE

Function 0221E118 Relevance: 1.6, APIs: 1, Instructions: 50
networkCOMMONLIBRARYCODE

Function 00007FFD9B880A75 Relevance: 1.5, APIs: 1, Instructions: 236
memoryCOMMON

Function 0222C1C8 Relevance: 1.4, APIs: 1, Instructions: 121
memoryCOMMONLIBRARYCODE

Function 0222C2EC Relevance: 1.3, APIs: 1, Instructions: 75
COMMONLIBRARYCODE