Edit tour

Windows Analysis Report
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Overview

General Information

Sample name:	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe renamed because original name is a hash value
Original sample name:	TBTAK SAGE TEKLF TALEP VE FYAT TEKLF sxlx..exe
Analysis ID:	1446501
MD5:	456442e5615445a54f15eae38140c50a
SHA1:	f81074ce9855601a33b97fb357fbee1bbdd7fcf6
SHA256:	0eca094ac422e8d7b0b58532b5a1fb7a59b4cc6cb6bbe1ec49259ebf10522ae5
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe (PID: 6548 cmdline: "C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe" MD5: 456442E5615445A54F15EAE38140C50A)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jsc.exe (PID: 6368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "cp8nl.hyperhost.ua", "Username": "royallog@fibraunollc.top", "Password": " 7213575aceACE@#$  "}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3233652969.00000000032B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000000.1972524893.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: jsc.exe PID: 6368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 6368	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.jsc.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.jsc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.jsc.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33559:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33675:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33751:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33877:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31759:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31875:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31951:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a77:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31759:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31875:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31951:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a77:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xd4f94:$s2: taskkill /IM cmstp.exe /F 0xd4ec6:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xd508a:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33559:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33675:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33751:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33877:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x10f9cc:$s2: taskkill /IM cmstp.exe /F 0x10f8fe:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x10fac2:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df1f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33559:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df91:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e01b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33675:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0ad:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e117:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33751:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e189:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e21f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33877:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2af:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x13b4fc:$s1: c:\windows\system32\cmstp.exe 0x13ad6c:$s2: taskkill /IM cmstp.exe /F 0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x13ac9e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x13ae62:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", "" 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.174.175.187, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe, Initiated: true, ProcessId: 6368, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "cp8nl.hyperhost.ua", "Username": "royallog@fibraunollc.top", "Password": " 7213575aceACE@#$ "}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Virustotal: Detection: 28%			Perma Link

Multi AV Scanner detection for submitted file

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	ReversingLabs: Detection: 36%
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.0% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: SAMPLE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1972524893.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: DROPPED

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 185.174.175.187:587

Source: Joe Sandbox View

IP Address: 185.174.175.187 185.174.175.187

Source: Joe Sandbox View

ASN Name: ITLDC-NLUA ITLDC-NLUA

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 185.174.175.187:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cp8nl.hyperhost.ua

Source: jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cp8nl.hyperhost.ua
Source: jsc.exe, 00000003.00000002.3233070835.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jsc.exe, 00000003.00000002.3235153161.0000000006680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: jsc.exe, 00000003.00000002.3233070835.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, hxAF.cs	.Net Code: gcE
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, hxAF.cs	.Net Code: gcE

System Summary

Malicious sample detected (through community Yara rule)

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: DROPPED	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C340560	0_2_00007FF77C340560
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C328F50	0_2_00007FF77C328F50
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C33C160	0_2_00007FF77C33C160
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C33EB10	0_2_00007FF77C33EB10
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C338D40	0_2_00007FF77C338D40
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C343600	0_2_00007FF77C343600
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C32FDA0	0_2_00007FF77C32FDA0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C342700	0_2_00007FF77C342700
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C337F10	0_2_00007FF77C337F10
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C317EC0	0_2_00007FF77C317EC0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C343F70	0_2_00007FF77C343F70
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C323720	0_2_00007FF77C323720
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3357F0	0_2_00007FF77C3357F0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C32F7F4	0_2_00007FF77C32F7F4
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C341800	0_2_00007FF77C341800
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C333010	0_2_00007FF77C333010
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C334890	0_2_00007FF77C334890
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3388C0	0_2_00007FF77C3388C0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3340D0	0_2_00007FF77C3340D0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C332934	0_2_00007FF77C332934
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3269D0	0_2_00007FF77C3269D0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3369D0	0_2_00007FF77C3369D0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3489D0	0_2_00007FF77C3489D0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C322A60	0_2_00007FF77C322A60
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C342290	0_2_00007FF77C342290
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C32E2F0	0_2_00007FF77C32E2F0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C33F360	0_2_00007FF77C33F360
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C33DC30	0_2_00007FF77C33DC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01769BE2	3_2_01769BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01764A98	3_2_01764A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0176CDA8	3_2_0176CDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01763E80	3_2_01763E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_017641C8	3_2_017641C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_065256F0	3_2_065256F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06523F60	3_2_06523F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0652DD10	3_2_0652DD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0652BD18	3_2_0652BD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06522AF8	3_2_06522AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06528BA3	3_2_06528BA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06520040	3_2_06520040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06523253	3_2_06523253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_06525010	3_2_06525010

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Code function: String function: 00007FF77C319B60 appears 51 times

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Binary or memory string: OriginalFilename vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFunc6DeclareLocal.dllD vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec25e7689-8eb9-43a0-830e-91b697d7907d.exe4 vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFunc6DeclareLocal.dllD vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Binary or memory string: OriginalFilenameFunc6DeclareLocal.dllD vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	Binary or memory string: OriginalFilenameFunc6DeclareLocal.dllD vs T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.7ff77c310000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, N43UVggPg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, N43UVggPg.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, Ow96S4wT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, MjzNdC.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, MjzNdC.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@4/2@1/1

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Code function: 0_2_00007FF77C322890 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF77C322890

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

File created: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	ReversingLabs: Detection: 36%
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

File read: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe "C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe"
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Static file information: File size 2070528 > 1048576

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: section name: .managed
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: section name: hydrated
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Static PE information: section name: _RDATA
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	Static PE information: section name: .managed
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	Static PE information: section name: hydrated
Source: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	File created: \t#u00dcb#u0130tak sage tekl#u0130f talep ve f#u0130yat tekl#u0130f#u0130 sxlx..exe
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	File created: \t#u00dcb#u0130tak sage tekl#u0130f talep ve f#u0130yat tekl#u0130f#u0130 sxlx..exe
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	File created: \t#u00dcb#u0130tak sage tekl#u0130f talep ve f#u0130yat tekl#u0130f#u0130 sxlx..exe	Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

File created: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Jump to dropped file

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

File created: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

File created: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory allocated: 286DCEF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 1760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 5216			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 865			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 3176	Thread sleep count: 5216 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 3176	Thread sleep count: 865 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98262s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97370s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -96891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Code function: 0_2_00007FF77C3224C0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF77C3224C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98262	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 97016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: jsc.exe, 00000003.00000002.3235153161.0000000006640000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllErroM

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C3155C0 RtlAddVectoredExceptionHandler,		0_2_00007FF77C3155C0
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Code function: 0_2_00007FF77C379808 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF77C379808

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 11FE008	Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Code function: 0_2_00007FF77C315270 cpuid

0_2_00007FF77C315270

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Code function: 0_2_00007FF77C31DD30 GetSystemTimeAsFileTime,

0_2_00007FF77C31DD30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.00000000032B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6368, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6368, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e187aac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.286e1840090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.00000000032B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 6368, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 Obfuscated Files or Information	1 Credentials in Registry	36 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	211 Security Software Discovery	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	37%	ReversingLabs	Win64.Trojan.Generic
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	28%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	37%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	28%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cp8nl.hyperhost.ua	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://aka.ms/dotnet-warnings/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	0%	Avira URL Cloud	safe
http://cp8nl.hyperhost.ua	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX	0%	Virustotal		Browse
http://cp8nl.hyperhost.ua	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cp8nl.hyperhost.ua	185.174.175.187	true	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe	false	URL Reputation: safe	unknown
https://account.dyn.com/	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/dotnet-warnings/	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3235153161.0000000006656000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe.0.dr	false	URL Reputation: safe	unknown
http://cp8nl.hyperhost.ua	jsc.exe, 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.174.175.187	cp8nl.hyperhost.ua	Ukraine		21100	ITLDC-NLUA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446501
Start date and time:	2024-05-23 15:12:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe renamed because original name is a hash value
Original Sample Name:	TBTAK SAGE TEKLF TALEP VE FYAT TEKLF sxlx..exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@4/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 56% Number of executed functions: 71 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:12:52	API Interceptor	30x Sleep call for process: jsc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.174.175.187	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130sxlx..exe	Get hash	malicious	AgentTesla	Browse
	TALEP VE F#U0130YAT TEKL#U0130F#U0130 FDP..exe	Get hash	malicious	AgentTesla	Browse
	Unilever Unilever Sanayi ve Ticaret Turk AS Purchase Order PO11824729sxlx..exe	Get hash	malicious	AgentTesla	Browse
	justificantes.scr.exe	Get hash	malicious	AgentTesla	Browse
	TGPF4-MG-002_Material Requirement for Sour Service_A.scr.exe	Get hash	malicious	AgentTesla	Browse
	130 FDP..exe	Get hash	malicious	AgentTesla	Browse
	FACTURAS.scr.exe	Get hash	malicious	AgentTesla	Browse
	F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	AgentTesla	Browse
	e-dekont_html.exe	Get hash	malicious	AgentTesla	Browse
	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 _xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cp8nl.hyperhost.ua	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130sxlx..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	TALEP VE F#U0130YAT TEKL#U0130F#U0130 FDP..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	Unilever Unilever Sanayi ve Ticaret Turk AS Purchase Order PO11824729sxlx..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	justificantes.scr.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	TGPF4-MG-002_Material Requirement for Sour Service_A.scr.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	130 FDP..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	FACTURAS.scr.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	e-dekont_html.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 _xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.174.175.187

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ITLDC-NLUA	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130sxlx..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	1.exe	Get hash	malicious	SmokeLoader	Browse	195.123.218.120
	TALEP VE F#U0130YAT TEKL#U0130F#U0130 FDP..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	Unilever Unilever Sanayi ve Ticaret Turk AS Purchase Order PO11824729sxlx..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	https://mt.tryd.pro/?utm_medium=5d539b8fe867f4649d0e7e9d483a8c0123849486&utm_campaign=Remnantnewtest&1=1	Get hash	malicious	Unknown	Browse	91.223.123.205
	CHNSoT10HG.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.174.174.220
	justificantes.scr.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	S9iJqTQS7q.exe	Get hash	malicious	RedLine	Browse	178.159.39.40
	TGPF4-MG-002_Material Requirement for Sour Service_A.scr.exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187
	130 FDP..exe	Get hash	malicious	AgentTesla	Browse	185.174.175.187

Process:	C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2070528
Entropy (8bit):	7.009704680519339
Encrypted:	false
SSDEEP:	24576:oynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52jOXuq01dKqOFWYuO:ZjN3CdJ81nEQhs30e1uqsrOFA
MD5:	456442E5615445A54F15EAE38140C50A
SHA1:	F81074CE9855601A33B97FB357FBEE1BBDD7FCF6
SHA-256:	0ECA094AC422E8D7B0B58532B5A1FB7A59B4CC6CB6BBE1EC49259EBF10522AE5
SHA-512:	B69F617E0DEB48AF12F230DCF016211F94EEA612F364357D84E96499F61B1BDC028CCA43BBFA7F8F169B2645F6F6D6F243671E4C10AB2080F9C5896B45BC8ED0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD, Description: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF, Source: C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 28%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6c.IW._IW._IW._O..^EW._O..^XW._O..^gW._@/._GW._./.^BW._IW._IV._.+.^BW._.+.^.W._IW._KW._#..^HW._#.._HW._#..^HW._RichIW._........................PE..d...vsNf.........."....&............\..........@..............................%...........`..........................................y..X....y........!....... .L1............%.4...p...........................(...0...@...............x............................text............................... ..`.managedh....0....... .............. ..`hydrated.................................rdata..............................@..@.data............"...x..............@....pdata..L1.... ..2..................@..@_RDATA........!.....................@..@.rsrc.........!.....................@..@.reloc..4.....%.....................@..B........................................................................................................

C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.009704680519339
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
File size:	2'070'528 bytes
MD5:	456442e5615445a54f15eae38140c50a
SHA1:	f81074ce9855601a33b97fb357fbee1bbdd7fcf6
SHA256:	0eca094ac422e8d7b0b58532b5a1fb7a59b4cc6cb6bbe1ec49259ebf10522ae5
SHA512:	b69f617e0deb48af12f230dcf016211f94eea612f364357d84e96499f61b1bdc028cca43bbfa7f8f169b2645f6f6d6f243671e4c10ab2080f9c5896b45bc8ed0
SSDEEP:	24576:oynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52jOXuq01dKqOFWYuO:ZjN3CdJ81nEQhs30e1uqsrOFA
TLSH:	78A5B005A3F801E4E46BC634C6599733D2B1B84A1734E58B0A5AD7822F73EE15BBF712
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6c.IW._IW._IW._O..^EW._O..^XW._O..^gW._@/._GW._./.^BW._IW._IV._.+.^BW._.+.^.W._IW._KW._#..^HW._#.._HW._#..^HW._RichIW._.......

File Icon


Icon Hash:	4f81888c8c89874f

Static PE Info

General

Entrypoint:	0x140068d5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664E7376 [Wed May 22 22:36:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	79856d4b034c49dc3dd3e403b25b6bbf

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD7D4D030ECh
dec eax
add esp, 28h
jmp 00007FD7D4D029E7h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007FD7D4D02B81h
dec eax
mov ecx, ebx
call 00007FD7D4D0B225h
test eax, eax
je 00007FD7D4D02B85h
dec eax
mov ecx, ebx
call 00007FD7D4D02897h
dec eax
test eax, eax
je 00007FD7D4D02B59h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007FD7D4D02B78h
call 00007FD7D4D0357Ch
int3
call 00007FD7D4D03596h
int3
jmp 00007FD7D4D035C4h
int3
int3
int3
jmp 00007FD7D4D02C2Ch
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FD7D4D02B82h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FD7D4D02B85h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FD7D4D02B7Dh
movzx eax, byte ptr [ecx+eax+00h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f79a0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f79f8	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21d000	0x3c1e6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x208000	0x1314c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25a000	0x634	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ca370	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ca500	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ca230	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17d000	0x778	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x71a88	0x71c00	5cdd54da137ec06542526019b1031732	False	0.4528288118131868	data	6.6410813091638	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x73000	0xb9168	0xb9200	2d30634d2eb96982ab12a2d431b95020	False	0.4601620526671168	data	6.463570386679756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x12d000	0x4f808	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17d000	0x7c4de	0x7c600	45fde1d586ca634d803af629131f3bfa	False	0.469921875	data	6.575391637700044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1fa000	0xdc90	0x2200	5c15d417ed4d359d82911c50efdabf9a	False	0.23793658088235295	data	3.6721787513471362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x208000	0x1314c	0x13200	8cc774a948808419be7ca4f4b39fb78d	False	0.4887280433006536	data	6.17164551981099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x21c000	0x1f4	0x200	cfc28b4453f40f4f91f4a52e36529a97	False	0.5078125	data	4.172727899540164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21d000	0x3c1e6	0x3c200	535b3db1e106e9738a2368c5f2218406	False	0.9869006626819127	data	7.992805950422709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25a000	0x634	0x800	8b35b44373572aa9287a6c541ff3e534	False	0.48681640625	data	4.726579003687373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x21d1c0	0x3aa94	data	1.0003371123208311
RT_ICON	0x257c54	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.37406191369606
RT_GROUP_ICON	0x258cfc	0x14	data	1.1
RT_VERSION	0x258d10	0x2ec	data	0.4144385026737968
RT_MANIFEST	0x258ffc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegSetValueExA, GetTokenInformation, DuplicateTokenEx, OpenThreadToken, RevertToSelf, ImpersonateLoggedOnUser, CheckTokenMembership, EventWrite, EventRegister, EventEnabled
bcrypt.dll	BCryptGenRandom, BCryptEncrypt, BCryptDecrypt, BCryptImportKey, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptCloseAlgorithmProvider, BCryptDestroyKey
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, RaiseException, RtlPcToFileHeader, CloseThreadpoolIo, GetStdHandle, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToSystemTime, GetSystemTime, GetCalendarInfoEx, CompareStringOrdinal, CompareStringEx, FindNLSStringEx, GetLocaleInfoEx, ResolveLocaleName, GetUserPreferredUILanguages, FindStringOrdinal, GetTickCount64, GetCurrentProcess, GetCurrentThread, Sleep, InitializeCriticalSection, InitializeConditionVariable, DeleteCriticalSection, LocalFree, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, QueryPerformanceCounter, WaitForMultipleObjectsEx, GetLastError, QueryPerformanceFrequency, SetLastError, GetFullPathNameW, GetLongPathNameW, MultiByteToWideChar, WideCharToMultiByte, LocalAlloc, GetConsoleOutputCP, GetProcAddress, RaiseFailFastException, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, LocaleNameToLCID, LCMapStringEx, EnumTimeFormatsEx, EnumCalendarInfoExEx, CopyFileExW, CreateFileW, DeleteFileW, DeviceIoControl, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileType, GetModuleFileNameW, GetOverlappedResult, GetSystemDirectoryW, LoadLibraryExW, ReadFile, SetFileInformationByHandle, SetThreadErrorMode, GetDynamicTimeZoneInformation, GetTimeZoneInformation, WriteFile, GetCurrentProcessorNumberEx, CloseHandle, SetEvent, CreateEventExW, GetEnvironmentVariableW, FormatMessageW, DuplicateHandle, GetThreadPriority, SetThreadPriority, GetConsoleMode, WriteConsoleW, GetExitCodeProcess, TerminateProcess, OpenProcess, K32EnumProcesses, GetProcessId, CreateProcessA, GetConsoleWindow, FreeConsole, AllocConsole, VirtualAllocEx, ResumeThread, CreateProcessW, GetThreadContext, SetThreadContext, FlushProcessWriteBuffers, GetCurrentThreadId, WaitForSingleObjectEx, VirtualQuery, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, SuspendThread, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, GetSystemTimeAsFileTime, ResetEvent, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, GetCurrentProcessId
ole32.dll	CoUninitialize, CoTaskMemAlloc, CoGetApartmentType, CoCreateGuid, CoTaskMemFree, CoWaitForMultipleHandles, CoInitializeEx
USER32.dll	LoadStringW
api-ms-win-crt-math-l1-1-0.dll	pow, modf, ceil, __setusermatherr
api-ms-win-crt-heap-l1-1-0.dll	calloc, malloc, _callnewh, _set_new_mode, free
api-ms-win-crt-string-l1-1-0.dll	wcsncmp, strncpy_s, _stricmp, strcpy_s, strcmp, _wcsicmp
api-ms-win-crt-runtime-l1-1-0.dll	_c_exit, _register_thread_local_exe_atexit_callback, _get_initial_wide_environment, _cexit, __p___wargv, __p___argc, _exit, exit, _initterm_e, _initterm, terminate, _crt_atexit, _initialize_wide_environment, _configure_wide_argv, _register_onexit_function, _initialize_onexit_table, _set_app_type, _seh_filter_exe, abort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf_s, __stdio_common_vsscanf, __stdio_common_vfprintf, __acrt_iob_func, _set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x1401fb360

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:12:53.260236979 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:53.265321016 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:53.265409946 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.029222965 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.030416965 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.035527945 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.328249931 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.328459024 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.333328962 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.527731895 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.533373117 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.538422108 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.733638048 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.734266996 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.734365940 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.736526012 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.739083052 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.739213943 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.821755886 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:54.859803915 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:54.866245031 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.040095091 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.068104029 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:55.073221922 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.241656065 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.242585897 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:55.247649908 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.417109966 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.418338060 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:55.423413038 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.603194952 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.603755951 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:55.608814001 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.799839973 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:55.800117970 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:55.806675911 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.058804989 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.059051991 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:56.068198919 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.256257057 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.256917000 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:56.256973982 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:56.257013083 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:56.257034063 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:12:56.261940956 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.267010927 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.315535069 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.315591097 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.629919052 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:12:56.670226097 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:14:33.264463902 CEST	49704	587	192.168.2.5	185.174.175.187
May 23, 2024 15:14:33.269871950 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:14:33.438318968 CEST	587	49704	185.174.175.187	192.168.2.5
May 23, 2024 15:14:33.443396091 CEST	49704	587	192.168.2.5	185.174.175.187

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:12:53.241302967 CEST	57800	53	192.168.2.5	1.1.1.1
May 23, 2024 15:12:53.252381086 CEST	53	57800	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 15:12:53.241302967 CEST	192.168.2.5	1.1.1.1	0x80b4	Standard query (0)	cp8nl.hyperhost.ua	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 23, 2024 15:12:53.252381086 CEST	1.1.1.1	192.168.2.5	0x80b4	No error (0)	cp8nl.hyperhost.ua		185.174.175.187	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 23, 2024 15:12:54.029222965 CEST	587	49704	185.174.175.187	192.168.2.5	220-cp8nl.hyperhost.ua ESMTP Exim 4.97.1 #2 Thu, 23 May 2024 16:12:53 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:12:54.030416965 CEST	49704	587	192.168.2.5	185.174.175.187	EHLO 066656
May 23, 2024 15:12:54.328249931 CEST	587	49704	185.174.175.187	192.168.2.5	250-cp8nl.hyperhost.ua Hello 066656 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:12:54.328459024 CEST	49704	587	192.168.2.5	185.174.175.187	STARTTLS
May 23, 2024 15:12:54.527731895 CEST	587	49704	185.174.175.187	192.168.2.5	220 TLS go ahead

Analysis Process: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exePID: 6548, Parent PID: 1028

General

Target ID:	0
Start time:	09:12:50
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe"
Imagebase:	0x7ff77c310000
File size:	2'070'528 bytes
MD5 hash:	456442E5615445A54F15EAE38140C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1972524893.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1980910200.00000286E183A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:12:50
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:12:51
Start date:	23/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0xe20000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3232681836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3233652969.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3233652969.00000000032B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3233652969.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exePID: 6548, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.7%
Total number of Nodes:	983
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF77C3224C0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C3224CF
GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C32250D
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C322539
GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C32254A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C322559
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C3225F0
GetProcessAffinityMask.KERNEL32 ref: 00007FF77C322603

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction ID: f71f1cff1adbe2cd3f46e3cdb723099231100c8ebbbe650d73ce92a19707e3a8
Opcode Fuzzy Hash: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction Fuzzy Hash: FA518A33A3CA4686EB00AF19A9449A9E3A1EF4CB94FD44135D94D473A5EE3EE405C721

Function 00007FF77C3155C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C31AE30: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C3155CB), ref: 00007FF77C31AE3B
Part of subcall function 00007FF77C31AE30: QueryInformationJobObject.KERNEL32 ref: 00007FF77C31AF0E

Part of subcall function 00007FF77C31ACD0: GetModuleHandleExW.KERNEL32(?,?,?,?,00007FF77C313699), ref: 00007FF77C31ACE1

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF77C315638

Part of subcall function 00007FF77C31D5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF77C31D6BD

Strings

StressLogLevel, xrefs: 00007FF77C315692
TotalStressLogSize, xrefs: 00007FF77C315659

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AllocExceptionHandleHandlerInformationModuleObjectQueryVectored_wcsicmp
String ID: StressLogLevel$TotalStressLogSize
API String ID: 2876344857-4058818204
Opcode ID: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction ID: 378b18ae7e42e85efe3ef1790e28cb42d06affeace502581cac4ad81cc2619e6
Opcode Fuzzy Hash: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction Fuzzy Hash: 76419433938E468BEB40BF24A0419B9E391AF8D788F841879ED4D17696DF2CE505C762

Function 00007FF77C328F50 Relevance: 2.9, Strings: 2, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Creation of WaitForGCEvent failed, xrefs: 00007FF77C3295C1
TraceGC is not turned on, xrefs: 00007FF77C328F5A

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: GlobalMemoryProcessQueryStatus$CurrentFrequencyInformationObjectPerformance
String ID: Creation of WaitForGCEvent failed$TraceGC is not turned on
API String ID: 133006248-518909315
Opcode ID: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction ID: 885965ccfa5d9e9e14f1f3d748bed3f06a27ad14b3f688aad6206e688efca9da
Opcode Fuzzy Hash: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction Fuzzy Hash: 9A028E23E3D70782FF54FB11A869A74A2D5AF4C790FE4493DD90E477A1EE2DA4408321

Function 00007FF77C33C160 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7a140566dae9a4fba68076e8192626d085c825284fdfb18a21c1693e6838f9
Instruction ID: c81ac99f2fe4caba7de7a857e3d24c9879b903a387a8485a6824441163b5261f
Opcode Fuzzy Hash: 2c7a140566dae9a4fba68076e8192626d085c825284fdfb18a21c1693e6838f9
Instruction Fuzzy Hash: B462C163A3874686FB25AB25A455B39F791BF4C780FE08739D90E53251EF3DE880C621

Function 00007FF77C340560 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 604403f3aac9de18e02c808f39cfdf9296956c65b9ee2d11eb55e13a3e953c9f
Instruction ID: 49c613f5ba7180e1417901cf45b703d51e27f0676786c451a810d9b2f4400a60
Opcode Fuzzy Hash: 604403f3aac9de18e02c808f39cfdf9296956c65b9ee2d11eb55e13a3e953c9f
Instruction Fuzzy Hash: 1902A473F3864687FB15EB25A895A34F791AF4C744FA48A39C40D5B260DF3EB580C621

Function 00007FF77C33EB10 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4758fcd36253205b66e6ee8f40eaefffe5d4d9abfaad721640ae2f4df7b9cc35
Instruction ID: 3eeda2e0687275014282e1d6b963e5ad02a08c731a9febd1d7f2ff7a922d1191
Opcode Fuzzy Hash: 4758fcd36253205b66e6ee8f40eaefffe5d4d9abfaad721640ae2f4df7b9cc35
Instruction Fuzzy Hash: 3EF19223D3DB4287FB42FB24AD55674E365AF5D384FE48739D40D112A2EF2EB5908221

Function 00007FF77C322070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF77C3220DE
IsProcessInJob.KERNEL32 ref: 00007FF77C3220EE
QueryInformationJobObject.KERNEL32 ref: 00007FF77C32211E
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF77C322187
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF77C3221CE
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF77C322245

Strings

@, xrefs: 00007FF77C32216F
@, xrefs: 00007FF77C32223A
@, xrefs: 00007FF77C3221C3

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction ID: f1753e4a923974e1deb67bb2a43ba261f49513cbefa5209e9c9d367b62b184fc
Opcode Fuzzy Hash: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction Fuzzy Hash: 37514032729BC185EB719F11E940BAAB3A0FB88B60F844135CA9D57B98DF3DE4458B11

Function 00007FF77C31AE30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C3155CB), ref: 00007FF77C31AE3B

Part of subcall function 00007FF77C3224C0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C3224CF
Part of subcall function 00007FF77C3224C0: GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C32250D
Part of subcall function 00007FF77C3224C0: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C322539
Part of subcall function 00007FF77C3224C0: GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C32254A
Part of subcall function 00007FF77C3224C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C31AE5A), ref: 00007FF77C322559

Part of subcall function 00007FF77C31D5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF77C31D6BD

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C3155CB), ref: 00007FF77C31AEAA
GetProcessAffinityMask.KERNEL32 ref: 00007FF77C31AEBD
QueryInformationJobObject.KERNEL32 ref: 00007FF77C31AF0E

Strings

PROCESSOR_COUNT, xrefs: 00007FF77C31AE76

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem_wcsicmp
String ID: PROCESSOR_COUNT
API String ID: 296690692-4048346908
Opcode ID: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction ID: 0b067643d8fc2d0aed2286813e713b40cacf1ea15d94f79e0132027237254795
Opcode Fuzzy Hash: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction Fuzzy Hash: F7318E73A38A438AEB54BB54D880AB9F3A0EF48755FD00439D65D43695DE2CE8498732

Function 00007FF77C316480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF77C316535
RaiseFailFastException.KERNEL32(?,?,?,00007FF77C3CCFD2,?,?,?,?,?,00007FF77C313941), ref: 00007FF77C316561
RaiseFailFastException.KERNEL32(?,?,?,00007FF77C3CCFD2), ref: 00007FF77C31659A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 00007FF77C316586

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: fec1ccdd5174ac2505eae89ee321da76851430eb507b79bb22477138be6a87ff
Instruction ID: b06696c52aed55362b113c3730be1804d492e569b76a9a8d6c060d733eb1993a
Opcode Fuzzy Hash: fec1ccdd5174ac2505eae89ee321da76851430eb507b79bb22477138be6a87ff
Instruction Fuzzy Hash: CE416A33A39A068BEB90EF55E454B69B3A0EB4CB88F944839DA4D43394DF3DE450C721

Function 00007FF77C31B130 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00007FF77C31B151
SetThreadPriority.KERNELBASE ref: 00007FF77C31B16D
ResumeThread.KERNELBASE ref: 00007FF77C31B176
FindCloseChangeNotification.KERNELBASE ref: 00007FF77C31B17F

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Thread$ChangeCloseCreateFindNotificationPriorityResume
String ID:
API String ID: 2150560229-0
Opcode ID: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction ID: b1b25d81038c806a689368a15a375bc45c1e264171bea015eb6db12cba791fa2
Opcode Fuzzy Hash: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction Fuzzy Hash: 6CE065A6A3570282EF14BB22B81433597906F9CB99F884434CE4E06360DF3C91854610

Function 00007FF77C321E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF77C321EC7
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF77C321F8C

Strings

@, xrefs: 00007FF77C321F84

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction ID: bde07d41430130d6d92de5773b7108f145484f8755410eaee38a365a4ac8ae03
Opcode Fuzzy Hash: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction Fuzzy Hash: 16412223A39B4641EF66DA369A10B39E2526F5DBD0F58C335E90E22744FF3DE891C610

Function 00007FF77C341470 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF77C32D326,?,-8000000000000000,00000001,00007FF77C33C4E6), ref: 00007FF77C3414FA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF77C32D326,?,-8000000000000000,00000001,00007FF77C33C4E6), ref: 00007FF77C341569
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF77C32D326,?,-8000000000000000,00000001,00007FF77C33C4E6), ref: 00007FF77C3415B2
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF77C32D326,?,-8000000000000000,00000001,00007FF77C33C4E6), ref: 00007FF77C3415C8

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b425638a6e70c30cd72ce7cc57c0788705c17328c805340536d3a1b7a1700000
Instruction ID: 154f4214511058c2a5c1aa9407896aaf4bb8c7885b117bd98ea09c3331b2855d
Opcode Fuzzy Hash: b425638a6e70c30cd72ce7cc57c0788705c17328c805340536d3a1b7a1700000
Instruction Fuzzy Hash: 5B519233A38A4292EB10EF11E854AB4F7A0FB08794FE40539DA5E47A95DF3CE655C321

Function 00007FF77C3502E0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF77C33D839), ref: 00007FF77C350320
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF77C33D839), ref: 00007FF77C350396
EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF77C33D839), ref: 00007FF77C3503EE
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF77C33D839), ref: 00007FF77C350414

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 13d948e5fa3df0cfca703f1770c43ab0ec44fa3814605dd8c07f8631823b0f7e
Instruction ID: 6dbc8894fb43e3a88ff3a2c68ae922f01585f5ec4a098e1b522cea45552e7a72
Opcode Fuzzy Hash: 13d948e5fa3df0cfca703f1770c43ab0ec44fa3814605dd8c07f8631823b0f7e
Instruction Fuzzy Hash: AC418363B3CA0692EB10FB11F854B79A694FF1C340FD50439DA4D4A692EE6EE540C321

Function 00007FF77C32CD40 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToThread.KERNEL32 ref: 00007FF77C32CE22
SwitchToThread.KERNEL32 ref: 00007FF77C32CE2B

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 0367fbf184d9da815e74a64e67e3c73c88d77959e1b0efac48cd030915a12f3a
Instruction ID: 64ea84fa874e64c1549ca62eea757c196172b3cfb420e276619d905d539b872b
Opcode Fuzzy Hash: 0367fbf184d9da815e74a64e67e3c73c88d77959e1b0efac48cd030915a12f3a
Instruction Fuzzy Hash: 03718D23E3864356FF64BF21B840A35E691AF0C784FA0053DE95D962E2DF3DF4408662

Function 00007FF77C322740 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00007FF77C325158,?,?,0000000A,00007FF77C3241B0,?,?,00000000,00007FF77C31E8A1), ref: 00007FF77C322767
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00007FF77C325158,?,?,0000000A,00007FF77C3241B0,?,?,00000000,00007FF77C31E8A1), ref: 00007FF77C322787
VirtualAllocExNuma.KERNEL32 ref: 00007FF77C3227A8

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction ID: 18fb20ec23fdaad101b0a5b55242d6b3675e6396423cdf88804a3d491c9014b1
Opcode Fuzzy Hash: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction Fuzzy Hash: 5CF0C872B286D182EB209F0AF500619EB60AB49FE4F880139EF8C17B58CF3DD5818B10

Function 00007FF77C319D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32(?,?,?,00007FF77C3156E4), ref: 00007FF77C319DA5

Strings

gcConservative, xrefs: 00007FF77C319E14

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: EventRegister
String ID: gcConservative
API String ID: 3840811365-1953527212
Opcode ID: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction ID: 5de142d2ac068cd01ec207c7777ba14899f55f0fb55ca655a9b521f5a348deed
Opcode Fuzzy Hash: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction Fuzzy Hash: 8631F733A38B478BEB40BB55E4849A5A760FF88748FA0083ADA0D07661DF3DE554C761

Function 00007FF77C378D70 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF77C378E79,?,?,?,?,00007FF77C31D9D1,?,?,?,00007FF77C31DF4C,00000000,00000020,?), ref: 00007FF77C378D8A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF77C378DA0

Part of subcall function 00007FF77C3797AC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF77C3797B5

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction ID: cdf85acd711554b6ce9ec3afc01b83f7a3b7bb137c9ce475588b22770b748c5a
Opcode Fuzzy Hash: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction Fuzzy Hash: 7FE0B602E3924751FF59356626978B491804F6F774EAC1B3CD93E192C2AD1CA4924633

Function 00007FF77C3364A0 Relevance: 2.6, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF77C33C51D), ref: 00007FF77C3365BA
LeaveCriticalSection.KERNEL32(?,?,?,00007FF77C33C51D), ref: 00007FF77C3365DB

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction ID: 460ccdcf42c40e4d4d86adaa515bd9576a5ebb67effaef7a0ead11ee91e4a13f
Opcode Fuzzy Hash: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction Fuzzy Hash: 06419463A38A4285EB10AB25A954679A360FF1CBF4F950339D97C876E9DF2DE040C361

Function 00007FF77C31FC50 Relevance: 2.6, APIs: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF77C31FCD0

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction ID: 828a898e058b5aeb93db6f2f8a69c2819af5564293c5115ffcb2e6bda236b4fe
Opcode Fuzzy Hash: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction Fuzzy Hash: 4031B233B35E5186E715AB16950053AA2A0EB4DBD4F848539DF4C17BA4DF38E4628391

Function 00007FF77C350440 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C3227D0: VirtualFree.KERNELBASE ref: 00007FF77C3227DA

EnterCriticalSection.KERNEL32(?,?,?,00007FF77C3364F9,?,?,?,00007FF77C33C51D), ref: 00007FF77C350472
LeaveCriticalSection.KERNEL32(?,?,?,00007FF77C3364F9,?,?,?,00007FF77C33C51D), ref: 00007FF77C35049C

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveVirtual
String ID:
API String ID: 1320683145-0
Opcode ID: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction ID: 9de87227e8310116cdd5edf37a56d7c54c7aa15731d1e68ee07130f6594acb90
Opcode Fuzzy Hash: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction Fuzzy Hash: 29F0D123E3864291EB10BB24F8886B9B7E4FF483A0FD40438D99D069A28E2DE440C720

Function 00007FF77C322700 Relevance: 2.5, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF77C322716
VirtualFree.KERNELBASE ref: 00007FF77C32272C

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction ID: 125f207934b51823bea29ee968d72742800a920ed7ce03980619e1b96d110544
Opcode Fuzzy Hash: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction Fuzzy Hash: 89E0C225F3710282EF18AB17A985E2597916F8DB10FC48038C40D03350DE2EA19B8B20

Function 00007FF77C32725E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF77C3272A4

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction ID: 2e3728e1b6b8a1193e5d409e1b700ee86c039615ed8c92d9c51272b951172c50
Opcode Fuzzy Hash: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction Fuzzy Hash: 9341A323E38A4242FF10AA16D4419B9A391FB8E7E0F940239EE5D537C5DF3CE542C251

Function 00007FF77C3B42C0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(?,?,?,?,00000010,?,?,?,?,?,?,?,00007FF77C3B421E), ref: 00007FF77C3B4312

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6fc7cc4146f5747cc890be62c27bf3cdfe6ca6f53a9e4cc5994f0fe45c4595da
Instruction ID: 20c7a93f941907c911520305e4832329d98a7b2613f58c50173b2cad218a4b09
Opcode Fuzzy Hash: 6fc7cc4146f5747cc890be62c27bf3cdfe6ca6f53a9e4cc5994f0fe45c4595da
Instruction Fuzzy Hash: B8212823E3C8259AF710BA619802DFDE6602F49794FD8443DDD4C17A86DE2CE9838362

Function 00007FF77C315780 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C31A840: VirtualQuery.KERNEL32 ref: 00007FF77C31A872

RaiseFailFastException.KERNEL32 ref: 00007FF77C315808

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastQueryRaiseVirtual
String ID:
API String ID: 3307674043-0
Opcode ID: 2c91771eec3dc57a2273c33921620eef897886fe8a235db23191d302b680ff9f
Instruction ID: 6c601c91ee74908fb357bfc7025804b1290b3286d820b9da701ad15c0575a894
Opcode Fuzzy Hash: 2c91771eec3dc57a2273c33921620eef897886fe8a235db23191d302b680ff9f
Instruction Fuzzy Hash: 0511A333A28B8182DB14EF25B44559AB360FB4A7B4F444339E6BD577D6DF38D0028702

Function 00007FF77C3227D0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF77C3227DA

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction ID: 6f8e5a3ac6f34e4b519e05905ad3650081a5efb1f741f3b596fdeae8c2db02b2
Opcode Fuzzy Hash: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction Fuzzy Hash: 43B01200F37002C2E70437237C8270806552B4DF16FC40034C608A1250CD1C91E51B21

Non-executed Functions

Function 00007FF77C322A60 Relevance: 111.8, Strings: 89, Instructions: 525COMMON

Download Yara Rule

Strings

BGCMLkp, xrefs: 00007FF77C323130
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF77C32327B
GCName, xrefs: 00007FF77C323349, 00007FF77C32336C
GCGen1MaxBudget, xrefs: 00007FF77C322E5B, 00007FF77C322EDB
System.GC.HeapHardLimitPercent, xrefs: 00007FF77C322EB9
ConfigLogFile, xrefs: 00007FF77C322FAD
BGCFLkd, xrefs: 00007FF77C3230AD
GCHeapHardLimitPOHPercent, xrefs: 00007FF77C3232CE
GCWriteBarrier, xrefs: 00007FF77C323321
GCCpuGroup, xrefs: 00007FF77C322BEA
ServerGC, xrefs: 00007FF77C322A8A
System.GC.LargePages, xrefs: 00007FF77C322C08
BGCMemGoal, xrefs: 00007FF77C322FF9
LogEnabled, xrefs: 00007FF77C322B75
NoAffinitize, xrefs: 00007FF77C322B62
BGCFLEnableKd, xrefs: 00007FF77C32317F
GCHeapHardLimitPercent, xrefs: 00007FF77C322EC8
GCRegionSize, xrefs: 00007FF77C322F17
ConfigLogEnabled, xrefs: 00007FF77C322B96
GCLowSkipRatio, xrefs: 00007FF77C322E79
GCHeapHardLimitPOH, xrefs: 00007FF77C323268
SegmentSize, xrefs: 00007FF77C322CF8
LogFileSize, xrefs: 00007FF77C322D52
GCHeapAffinitizeMask, xrefs: 00007FF77C322D9D
GCHighMemPercent, xrefs: 00007FF77C322E0C
LOHCompactionMode, xrefs: 00007FF77C322C40
BGCMLki, xrefs: 00007FF77C323143
System.GC.HeapHardLimitPOH, xrefs: 00007FF77C323259
LatencyMode, xrefs: 00007FF77C322D16
BGCFLEnableKi, xrefs: 00007FF77C323161
BGCFLSweepGoal, xrefs: 00007FF77C323035
ConservativeGC, xrefs: 00007FF77C322AC8
BGCMemGoalSlack, xrefs: 00007FF77C323017
BGCFLSmoothFactor, xrefs: 00007FF77C3230E9
GCEnabledInstructionSets, xrefs: 00007FF77C3232E1
System.GC.Server, xrefs: 00007FF77C322A7B
BGCSpin, xrefs: 00007FF77C322C9A
LatencyLevel, xrefs: 00007FF77C322D34
System.GC.NoAffinitize, xrefs: 00007FF77C322B50
GCHeapHardLimitSOH, xrefs: 00007FF77C323224
System.GC.HeapAffinitizeMask, xrefs: 00007FF77C322D8E
System.GC.HeapHardLimitSOH, xrefs: 00007FF77C323215
BGCFLki, xrefs: 00007FF77C32308F
RetainVM, xrefs: 00007FF77C322B1C
GCHeapHardLimitLOH, xrefs: 00007FF77C323246
GCGen0MaxBudget, xrefs: 00007FF77C322E3D
GCHeapHardLimitLOHPercent, xrefs: 00007FF77C3232AF
GCConserveMem, xrefs: 00007FF77C32330E
LogFile, xrefs: 00007FF77C322F69
BGCG2RatioStep, xrefs: 00007FF77C3231F7
GCHeapHardLimit, xrefs: 00007FF77C322EA6
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF77C3232BF
System.GC.HeapCount, xrefs: 00007FF77C322CB8
BGCFLEnableSmooth, xrefs: 00007FF77C32319D
System.GC.Concurrent, xrefs: 00007FF77C322AA3
System.GC.Name, xrefs: 00007FF77C323342, 00007FF77C32335A
GCProvModeStress, xrefs: 00007FF77C322E1F
System.GC.HeapAffinitizeRanges, xrefs: 00007FF77C322DB0, 00007FF77C322DD1
GCNumaAware, xrefs: 00007FF77C322BB7
GCLargePages, xrefs: 00007FF77C322C12
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF77C3232A5
GCConfigLogFile, xrefs: 00007FF77C322F9C
BGCFLGradualD, xrefs: 00007FF77C323107
BGCFLSweepGoalLOH, xrefs: 00007FF77C323053
GCHeapHardLimitSOHPercent, xrefs: 00007FF77C32328A
GCRegionRange, xrefs: 00007FF77C322EF9
System.GC.ConserveMemory, xrefs: 00007FF77C3232FF
BGCFLff, xrefs: 00007FF77C3230CB
GCHeapAffinitizeRanges, xrefs: 00007FF77C322DBC, 00007FF77C322DDD
BGCFLEnableTBH, xrefs: 00007FF77C3231BB
BreakOnOOM, xrefs: 00007FF77C322B2F
BGCFLEnableFF, xrefs: 00007FF77C3231D9
Gen0Size, xrefs: 00007FF77C322CDA
LOHThreshold, xrefs: 00007FF77C322C5E
System.GC.CpuGroup, xrefs: 00007FF77C322BD8
BGCSpinCount, xrefs: 00007FF77C322C7C
System.GC.HeapHardLimit, xrefs: 00007FF77C322E97
System.GC.RetainVM, xrefs: 00007FF77C322B0A
HeapVerifyLevel, xrefs: 00007FF77C322C22
ConcurrentGC, xrefs: 00007FF77C322AB5
BGCFLTuningEnabled, xrefs: 00007FF77C322FDB
GCLogFile, xrefs: 00007FF77C322F58
GCEnableSpecialRegions, xrefs: 00007FF77C322F35
HeapCount, xrefs: 00007FF77C322CC7
System.GC.HeapHardLimitLOH, xrefs: 00007FF77C323237
CompactRatio, xrefs: 00007FF77C322D70
BGCFLkp, xrefs: 00007FF77C323071
System.GC.HighMemoryPercent, xrefs: 00007FF77C322DFD
ForceCompact, xrefs: 00007FF77C322AE9

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$BreakOnOOM$CompactRatio$ConcurrentGC$ConfigLogEnabled$ConfigLogFile$ConservativeGC$ForceCompact$GCConfigLogFile$GCConserveMem$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapAffinitizeRanges$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLargePages$GCLogFile$GCLowSkipRatio$GCName$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCWriteBarrier$Gen0Size$HeapCount$HeapVerifyLevel$LOHCompactionMode$LOHThreshold$LatencyLevel$LatencyMode$LogEnabled$LogFile$LogFileSize$NoAffinitize$RetainVM$SegmentSize$ServerGC$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapAffinitizeRanges$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.Name$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server
API String ID: 0-658696054
Opcode ID: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction ID: 291c51aa8f4b04b0890bbba4c3966093138e34f7e914ea361b18f9ef7b063fdd
Opcode Fuzzy Hash: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction Fuzzy Hash: 69324D62638E5642EB60BB16F850AAAA765FF4D7C8FC15132DA8C07F28DF3DD2118714

Function 00007FF77C323720 Relevance: 102.8, Strings: 82, Instructions: 270COMMON

Download Yara Rule

Strings

BGCMLkp, xrefs: 00007FF77C323B87
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF77C323C7B
GCGen1MaxBudget, xrefs: 00007FF77C3239EE
GCCompactRatio, xrefs: 00007FF77C32397B
System.GC.HeapHardLimitPercent, xrefs: 00007FF77C323A30
BGCFLkd, xrefs: 00007FF77C323B33
GCHeapHardLimitPOHPercent, xrefs: 00007FF77C323CB6
GCWriteBarrier, xrefs: 00007FF77C323CFA
GCCpuGroup, xrefs: 00007FF77C323854
gcConservative, xrefs: 00007FF77C32376D
gcForceCompact, xrefs: 00007FF77C323788
System.GC.LargePages, xrefs: 00007FF77C32386D
BGCMemGoal, xrefs: 00007FF77C323AB5
GCConfigLogEnabled, xrefs: 00007FF77C323819
BGCFLEnableKd, xrefs: 00007FF77C323BC6
GCLogEnabled, xrefs: 00007FF77C3237FE
GCHeapHardLimitPercent, xrefs: 00007FF77C323A37
GCRegionSize, xrefs: 00007FF77C323A76
GCLowSkipRatio, xrefs: 00007FF77C323A03
GCgen0size, xrefs: 00007FF77C323912
gcConcurrent, xrefs: 00007FF77C323752
GCHeapHardLimitPOH, xrefs: 00007FF77C323C68
GCLOHThreshold, xrefs: 00007FF77C3238B9
GCHeapAffinitizeMask, xrefs: 00007FF77C323995
GCHighMemPercent, xrefs: 00007FF77C3239AF
BGCMLki, xrefs: 00007FF77C323B9C
System.GC.HeapHardLimitPOH, xrefs: 00007FF77C323C61
GCTotalPhysicalMemory, xrefs: 00007FF77C323A4C
BGCFLEnableKi, xrefs: 00007FF77C323BB1
BGCFLSweepGoal, xrefs: 00007FF77C323ADF
BGCMemGoalSlack, xrefs: 00007FF77C323ACA
BGCFLSmoothFactor, xrefs: 00007FF77C323B5D
GCEnabledInstructionSets, xrefs: 00007FF77C323CCB
GCNoAffinitize, xrefs: 00007FF77C3237E3
System.GC.Server, xrefs: 00007FF77C32372B
BGCSpin, xrefs: 00007FF77C3238E3
HeapVerify, xrefs: 00007FF77C32388F
System.GC.NoAffinitize, xrefs: 00007FF77C3237DC
GCHeapHardLimitSOH, xrefs: 00007FF77C323C34
GCRetainVM, xrefs: 00007FF77C3237A8
GCLOHCompact, xrefs: 00007FF77C3238A4
System.GC.HeapAffinitizeMask, xrefs: 00007FF77C32398E
System.GC.HeapHardLimitSOH, xrefs: 00007FF77C323C2D
BGCFLki, xrefs: 00007FF77C323B1E
GCLogFileSize, xrefs: 00007FF77C323966
GCHeapHardLimitLOH, xrefs: 00007FF77C323C4E
GCGen0MaxBudget, xrefs: 00007FF77C3239D9
GCHeapHardLimitLOHPercent, xrefs: 00007FF77C323C9C
GCLatencyLevel, xrefs: 00007FF77C323951
GCBreakOnOOM, xrefs: 00007FF77C3237C3
GCLatencyMode, xrefs: 00007FF77C32393C
BGCG2RatioStep, xrefs: 00007FF77C323C1A
GCHeapHardLimit, xrefs: 00007FF77C323A1D
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF77C323CAF
System.GC.HeapCount, xrefs: 00007FF77C3238F6
BGCFLEnableSmooth, xrefs: 00007FF77C323BDB
System.GC.Concurrent, xrefs: 00007FF77C32374B
GCProvModeStress, xrefs: 00007FF77C3239C4
GCNumaAware, xrefs: 00007FF77C323834
GCLargePages, xrefs: 00007FF77C323874
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF77C323C95
BGCFLGradualD, xrefs: 00007FF77C323B72
BGCFLSweepGoalLOH, xrefs: 00007FF77C323AF4
GCHeapHardLimitSOHPercent, xrefs: 00007FF77C323C82
GCRegionRange, xrefs: 00007FF77C323A61
System.GC.ConserveMemory, xrefs: 00007FF77C323CDE
BGCFLff, xrefs: 00007FF77C323B48
BGCFLEnableTBH, xrefs: 00007FF77C323BF0
BGCFLEnableFF, xrefs: 00007FF77C323C05
System.GC.CpuGroup, xrefs: 00007FF77C32384D
BGCSpinCount, xrefs: 00007FF77C3238CE
System.GC.HeapHardLimit, xrefs: 00007FF77C323A16
gcServer, xrefs: 00007FF77C323732
System.GC.RetainVM, xrefs: 00007FF77C3237A1
BGCFLTuningEnabled, xrefs: 00007FF77C323AA0
GCConserveMemory, xrefs: 00007FF77C323CE5
GCEnableSpecialRegions, xrefs: 00007FF77C323A8B
GCSegmentSize, xrefs: 00007FF77C323927
System.GC.HeapHardLimitLOH, xrefs: 00007FF77C323C47
BGCFLkp, xrefs: 00007FF77C323B09
GCHeapCount, xrefs: 00007FF77C3238FD
System.GC.HighMemoryPercent, xrefs: 00007FF77C3239A8

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$GCBreakOnOOM$GCCompactRatio$GCConfigLogEnabled$GCConserveMemory$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapCount$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLOHCompact$GCLOHThreshold$GCLargePages$GCLatencyLevel$GCLatencyMode$GCLogEnabled$GCLogFileSize$GCLowSkipRatio$GCNoAffinitize$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCRetainVM$GCSegmentSize$GCTotalPhysicalMemory$GCWriteBarrier$GCgen0size$HeapVerify$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server$gcConcurrent$gcConservative$gcForceCompact$gcServer
API String ID: 0-2080704861
Opcode ID: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction ID: 45db11e742b9cc91deb716737856365010ee753ce253792155eb2a9f7eb1cb61
Opcode Fuzzy Hash: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction Fuzzy Hash: 1BF125A3D38E47A5FB40FB66EC504F5A766AF8C304BD488B7D00D4606A9E2DB259C371

Function 00007FF77C322890 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF77C3228CC
GetCurrentProcess.KERNEL32 ref: 00007FF77C3228F4
OpenProcessToken.ADVAPI32 ref: 00007FF77C322907
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF77C32292C
GetLastError.KERNEL32 ref: 00007FF77C322934
CloseHandle.KERNEL32 ref: 00007FF77C322941
GetLargePageMinimum.KERNEL32 ref: 00007FF77C322956
VirtualAlloc.KERNEL32 ref: 00007FF77C322987
GetCurrentProcess.KERNEL32 ref: 00007FF77C322993
VirtualAllocExNuma.KERNEL32 ref: 00007FF77C3229B3

Strings

SeLockMemoryPrivilege, xrefs: 00007FF77C3228C5

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction ID: 58a46ed7f69aa078b937c0bc4fa9ebb850d7c6005bbe3bb9af6d5f77d95e3c1f
Opcode Fuzzy Hash: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction Fuzzy Hash: 15319323A3D64386FB20AB62B944B76E7A1EF88B98F940039DA4D47754DE3DD0458B20

Function 00007FF77C317EC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF77C318880,?,?,?,?,?,?,?,?,?), ref: 00007FF77C317F4B
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF77C318880,?,?,?,?,?,?,?,?,?), ref: 00007FF77C3180AA
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF77C318880,?,?,?,?,?,?,?,?,?), ref: 00007FF77C3181A0
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF77C318880,?,?,?,?,?,?,?,?,?), ref: 00007FF77C3181B6
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF77C318880,?,?,?,?,?,?,?,?,?), ref: 00007FF77C318216

Strings

[ KeepUnwinding ], xrefs: 00007FF77C3181CA

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction ID: fb055405b91500f9e56249f393f38ec110db5c46e364609900e0ac5d44123161
Opcode Fuzzy Hash: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction Fuzzy Hash: 69C1A233624F468AEB55AF25D440AA973A1FB09B88F984539CE4D07398CF39D495C323

Function 00007FF77C315270 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF77C315581

Strings

The required instruction sets are not supported by the current CPU., xrefs: 00007FF77C31556E

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: The required instruction sets are not supported by the current CPU.
API String ID: 2546344036-3318624164
Opcode ID: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction ID: 68cd2930f4ac5096fe451fe207accc024b55232e6235e4460cc13f8ec9c38f33
Opcode Fuzzy Hash: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction Fuzzy Hash: 38719073B38A3A4BF7606B1D6849D38A6916F69344FF00C3DD40D4BA91CE3EB6505BA1

Function 00007FF77C33DC30 Relevance: 2.0, APIs: 1, Instructions: 456COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C321CC0: CreateEventW.KERNEL32 ref: 00007FF77C321D01

Part of subcall function 00007FF77C322690: QueryPerformanceCounter.KERNEL32 ref: 00007FF77C322699

DebugBreak.KERNEL32 ref: 00007FF77C33E3EA

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: BreakCounterCreateDebugEventPerformanceQuery
String ID:
API String ID: 4239280443-0
Opcode ID: c34d052a868cd4b60924c0b1e92cbc460f46e007d6bb4a206f187a08c30cf7c3
Instruction ID: 96769425f63170ca472c4ed095f49450a65ef1ada490c169ac57cf392130a478
Opcode Fuzzy Hash: c34d052a868cd4b60924c0b1e92cbc460f46e007d6bb4a206f187a08c30cf7c3
Instruction Fuzzy Hash: 8C42E873D38B4286E700EB25F898674B7A4FB5D744FA05A39D98C12765EF3EA190D320

Function 00007FF77C341800 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

, xrefs: 00007FF77C341DDC

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction ID: 63947af2658a6456bd9a2d1e852805eda2659b6fbb3aaacc836c0fef117a170b
Opcode Fuzzy Hash: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction Fuzzy Hash: 4252B233A38F8682EB109F19E854A79B7A1FB49794FA00636C95D4B7A0DF3DE550C321

Function 00007FF77C337F10 Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}, xrefs: 00007FF77C3386FB

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID: ========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}
API String ID: 0-2256439813
Opcode ID: 061b6938f4016a34bcb0bd81591986c075d9c77a106380fc5b89187094526531
Instruction ID: 0f1c4e52969fa9e73508ff2a4f69e87eb03bb511aa0fe27db45263a76ff32a16
Opcode Fuzzy Hash: 061b6938f4016a34bcb0bd81591986c075d9c77a106380fc5b89187094526531
Instruction Fuzzy Hash: 5542A032A39B8287EB05AB19D454379B7A1FF08B48FA4453ACA4D07361DF3EE065C721

Function 00007FF77C32E2F0 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF77C32E33E

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction ID: 90b70e7e56f73105f38502e0743a1d30d719643328fea15c735d0b90ad7c8634
Opcode Fuzzy Hash: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction Fuzzy Hash: 7B12DD33A38A8282EF10EB05E445AB9B3A5FB48B94F94463ADE5D47794DF3CE444C721

Function 00007FF77C31DD30 Relevance: 1.6, APIs: 1, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF77C3156DF), ref: 00007FF77C31DDFC

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 5c980d6ba46e3a73f0dcc2ee7f1a165251c54b4aeab7c0793880b0067312ad67
Instruction ID: 9671dcf16961bc7d960c390235d4d65a44bc4663a56c17fa73ee5fe56b3c3bff
Opcode Fuzzy Hash: 5c980d6ba46e3a73f0dcc2ee7f1a165251c54b4aeab7c0793880b0067312ad67
Instruction Fuzzy Hash: 2F214B32E38B429BE780BB65A8446A6B2E0EB4D340FA08979E54C43761DF3EE440C761

Function 00007FF77C3340D0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 00007FF77C334313

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-3916222277
Opcode ID: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction ID: accf3a10277ce12eadb89ae0aa19fb61317facbd6d35b699ca6e73085907808b
Opcode Fuzzy Hash: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction Fuzzy Hash: 62D1E363A38A4682FB00AB25E850679BBA0FF49BA4F944739DA6D537D4DF3CE051C311

Function 00007FF77C342700 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9884e8459a2da4eee788d28edbed6ad75013be01f180accf8dedfb5a0459d2e
Instruction ID: e1c0e67a015ad2680a7d32af287b372be012fc332832a503bbf5b8480e4e3ceb
Opcode Fuzzy Hash: d9884e8459a2da4eee788d28edbed6ad75013be01f180accf8dedfb5a0459d2e
Instruction Fuzzy Hash: 8492D263E38B4646EB41BB55A858EB4E391AF0DBC4FD4453AD80E6B360DF3EE5418321

Function 00007FF77C343600 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction ID: 2270bb6126b7b6a6af8ddf1ebef09f2524112bf00d7c43e88d3fbc347ddb9ec9
Opcode Fuzzy Hash: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction Fuzzy Hash: 4C429D63B38B4286EB50AF25E8405B9B7A1FB48BC8F54053AEE4D1BB58DE3CE541C711

Function 00007FF77C343F70 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction ID: 878c290c7a7bdf94fc2da905d58f1aab04251b03698dcc1abe96f1d645268a69
Opcode Fuzzy Hash: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction Fuzzy Hash: A632B173F39B4586FB10DF65D840ABCA7A1EB08B88B94053ACE0D5B788DE38E555C361

Function 00007FF77C32FDA0 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction ID: 7208f90010d4b80699806cb2f4ea42c8887a6363092fcfcc515be5a539e35efc
Opcode Fuzzy Hash: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction Fuzzy Hash: B802C273B34A4287EB149F19E444AB8B360AB49BA4FD0463ACA6D5B7D5CF3DE441C321

Function 00007FF77C3369D0 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9fc67e00198cb791d6b42d7e224a19ac5270105391cad9a71a2955a2d292d9
Instruction ID: 452ea14fe093492cabd1ff6ce75a851e601e71d9f4050ab24a4d888f962a8ffd
Opcode Fuzzy Hash: ae9fc67e00198cb791d6b42d7e224a19ac5270105391cad9a71a2955a2d292d9
Instruction Fuzzy Hash: 8BF13823F39B4D45EA12A6379501BB4D6617F6E7C4E6DCB36E84D367A0EF2CB0818610

Function 00007FF77C334890 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction ID: 51838dd0d443b27e69121723f4dd6f38ca4e16993d5dfbc3baa9df555fce655a
Opcode Fuzzy Hash: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction Fuzzy Hash: 8EF1EF63A38B8582EB00AF299844678BB61FB59BA4F948335DE6D07795DF3DE181C310

Function 00007FF77C32F7F4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-0
Opcode ID: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction ID: 5c212319d2d1b391f7d570f18c63598473eb3a7f8d65fbf6d6e5a2ecfd3633a0
Opcode Fuzzy Hash: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction Fuzzy Hash: B2029023A39B5645FF12BB28A454734A7A0BF4DB98FA44639CD4D533A0DF3EE481C221

Function 00007FF77C3489D0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction ID: 5d27556c7b021d83ecaec66ed911ed047d8c10e753da391e438d8d892b0b813e
Opcode Fuzzy Hash: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction Fuzzy Hash: C2E1C273A3978587EB51AB15D854778B7A1FB48B80F90463AC94D873A0DF3DE584C312

Function 00007FF77C332934 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction ID: fafafc9c9ca9608a483dcc113efc715e5d6f3d8a628c1d52bc5f878c1eed0a23
Opcode Fuzzy Hash: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction Fuzzy Hash: BEE13513E3AFC549E717E7359011B74E358AF6A7C0F948336ED4F26662DF2AA1828211

Function 00007FF77C3388C0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction ID: cc6dafac2e36aceeeede895f641c6badffa00d6ec1617387a9e3b112a8651bc5
Opcode Fuzzy Hash: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction Fuzzy Hash: 36C17D73A38B4682EB00AF09E854679B760EB49BA4FD44636C96D477A0DF3DE450C322

Function 00007FF77C342290 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction ID: a4ba30d7121749e82a453d36e9be56cbf443116732b89c6f8d289cfedc9d431b
Opcode Fuzzy Hash: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction Fuzzy Hash: 7EC19F33A38B4682EB00EB09E854979F761EB49BA4BD40636C95D577A0DF3EE550C320

Function 00007FF77C3357F0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction ID: 594a4c869c1055740ea5facf31be8605577fdba375f5b5efe84c0ac6883845bb
Opcode Fuzzy Hash: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction Fuzzy Hash: D291E473B34A9587DB549F0AE484AA8BBA2F789BD0F85403ADA4E87B45DF3DD404C710

Function 00007FF77C3269D0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction ID: bd3f7406d888b32980e010a2327a1c0db806ce86e988b68b0ab5214b4ba24d99
Opcode Fuzzy Hash: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction Fuzzy Hash: 62916F73A39B8296E710AB15E8447AAB3A4FB5C784FA0453ADA8D83761DF3DE044C711

Function 00007FF77C338D40 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction ID: 95054ab559393e21ba348f6ce6d99234b3219618fe64ad152622c444f2b75874
Opcode Fuzzy Hash: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction Fuzzy Hash: 1351E723B3AB4E41EB06977B5101AB9C5525F5E7C0E9CCB36E90E36790EF3DB0908612

Function 00007FF77C333010 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction ID: 1d7e3a5d40f3be72f5494825587c7a60dc8d984ff6955c402b2b67cbcbffc3cc
Opcode Fuzzy Hash: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction Fuzzy Hash: 80611433E38F854AD756EB249446D68E35ABF497C0BA4D335D90FA3252DF3DA0A2C610

Function 00007FF77C33F360 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction ID: e71fdc52bee1a004cf8651de27b9582a9130467cdd9746a2c341d721a515d68e
Opcode Fuzzy Hash: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction Fuzzy Hash: C4210A23B3C24242EF94AB39A296E7D5350EF8D794FD42175DE0C03B86DD2DD5914701

Function 00007FF77C31A990 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31A9B3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31A9C8
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31A9D5
InitializeContext.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31AA14
GetLastError.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31AA22
InitializeContext.KERNEL32(?,?,?,?,?,00007FF77C315E6A), ref: 00007FF77C31AA76

Strings

InitializeContext2, xrefs: 00007FF77C31A9BE
kernel32.dll, xrefs: 00007FF77C31A9AC

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: edabfeb27e12de1ac58e4de23520e38ce78f3386a9e832e640fcf79b6a971462
Instruction ID: b420b42e3a66ed8426349f775be682d5d49d6013a7126c011e0b87ee335f94e7
Opcode Fuzzy Hash: edabfeb27e12de1ac58e4de23520e38ce78f3386a9e832e640fcf79b6a971462
Instruction Fuzzy Hash: 80318423A39B4686FB01AB56B640A29E7E0BF8CB95F840435DD5D037A4DF7CE446C721

Function 00007FF77C315D00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF77C31AD41
GetProcAddress.KERNEL32 ref: 00007FF77C31AD51
GetLastError.KERNEL32 ref: 00007FF77C31ADA4
SuspendThread.KERNEL32 ref: 00007FF77C31ADBD
GetThreadContext.KERNEL32 ref: 00007FF77C31ADD8
ResumeThread.KERNEL32 ref: 00007FF77C31AE02

Strings

QueueUserAPC2, xrefs: 00007FF77C31AD4A
kernel32, xrefs: 00007FF77C31AD34

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Thread$AddressContextErrorLastLibraryLoadProcResumeSuspend
String ID: QueueUserAPC2$kernel32
API String ID: 3714266957-4022151419
Opcode ID: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction ID: 2dd1cb5515d33b336cc800f203909493216e39f3f7ad5ad1c660edb887daff49
Opcode Fuzzy Hash: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction Fuzzy Hash: DF31C232B38E0246FB50BB15E954779B3A1AF4CBA5FD00638DD2D866E0DF2CE4428721

Function 00007FF77C32D9F0 Relevance: 10.7, APIs: 7, Instructions: 227threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF77C32DAB1
SwitchToThread.KERNEL32 ref: 00007FF77C32DB5A
SwitchToThread.KERNEL32 ref: 00007FF77C32DB63
SwitchToThread.KERNEL32 ref: 00007FF77C32DC9A
SwitchToThread.KERNEL32 ref: 00007FF77C32DCA3
SwitchToThread.KERNEL32 ref: 00007FF77C32DCCD

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction ID: ec83fd575214c8065a6c07e2572c6db6b0386ef2ed5124d198bdd55092d224b2
Opcode Fuzzy Hash: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction Fuzzy Hash: 99A17933E3C6134AFB54BB25A851E75E290AF1C754FE0053DE81D86AD5EE2EB840C672

Function 00007FF77C332240 Relevance: 10.6, APIs: 7, Instructions: 134threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77C33224F
EnterCriticalSection.KERNEL32 ref: 00007FF77C332287
LeaveCriticalSection.KERNEL32 ref: 00007FF77C33229F
SwitchToThread.KERNEL32 ref: 00007FF77C33235A
SwitchToThread.KERNEL32 ref: 00007FF77C332363
SwitchToThread.KERNEL32 ref: 00007FF77C33238D
LeaveCriticalSection.KERNEL32 ref: 00007FF77C332432

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Thread$CriticalSectionSwitch$Leave$CurrentEnter
String ID:
API String ID: 2584832284-0
Opcode ID: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction ID: ee5b1c0940dfe8bae446d4073b08707e52e317fe0197d43d39f78525e8b7c825
Opcode Fuzzy Hash: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction Fuzzy Hash: 8F514133E3D21387FB54BB259855E79A691AF0C750FD0093DE80D862D3EE2EB4418A72

Function 00007FF77C316100 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77C31613A
GetCurrentProcess.KERNEL32 ref: 00007FF77C316148
GetCurrentThread.KERNEL32 ref: 00007FF77C316150
DuplicateHandle.KERNEL32 ref: 00007FF77C316174

Part of subcall function 00007FF77C31A840: VirtualQuery.KERNEL32 ref: 00007FF77C31A872

RaiseFailFastException.KERNEL32 ref: 00007FF77C3161A2

Strings

, xrefs: 00007FF77C3161B6

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: fabd27e107bbfd348c5fcb363ee42fc01df79ff2f7dd51d048f6b6b90d90cb7c
Instruction ID: 1f6f55704ba5842ea8436cc32a2e864da2d8ddde657dd93e352b875ac6e0fc96
Opcode Fuzzy Hash: fabd27e107bbfd348c5fcb363ee42fc01df79ff2f7dd51d048f6b6b90d90cb7c
Instruction Fuzzy Hash: 4C11B073A18B818AD750EF55A44159AB360FB497B4F440338E6BD4BAD6CF38D5428701

Function 00007FF77C33D410 Relevance: 9.2, APIs: 6, Instructions: 189threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF77C33D4DA
SwitchToThread.KERNEL32 ref: 00007FF77C33D4E3
SwitchToThread.KERNEL32 ref: 00007FF77C33D50D
SwitchToThread.KERNEL32 ref: 00007FF77C33D63F
SwitchToThread.KERNEL32 ref: 00007FF77C33D648
SwitchToThread.KERNEL32 ref: 00007FF77C33D672

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction ID: 5ddd1d626037c4bd645aedb757143c9ee890d617bacfcd28a0583db0fee62454
Opcode Fuzzy Hash: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction Fuzzy Hash: 45812823F3C6034BF714BB259841A35A291AF4C754FE0053DE96D866D6EE2EF8408A32

Function 00007FF77C339F60 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction ID: f1e9c7a7536d3b1c16292dc9682f453cac80a69a83fb7ed7f826ca28bed75c4e
Opcode Fuzzy Hash: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction Fuzzy Hash: EC71A163A3D74282FB50BB619944AB9E3A0BF48B94FD8053DDE1D07A99DF3DE4508321

Function 00007FF77C33F8F0 Relevance: 7.8, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF77C33FCDA
LeaveCriticalSection.KERNEL32 ref: 00007FF77C33FD1F
EnterCriticalSection.KERNEL32 ref: 00007FF77C33FDD7
LeaveCriticalSection.KERNEL32 ref: 00007FF77C33FDF8
EnterCriticalSection.KERNEL32 ref: 00007FF77C33FE3C
LeaveCriticalSection.KERNEL32 ref: 00007FF77C33FE5D

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: dfead87ec6108077648ad3825d3ea0080477edc8ca47081f20bdd0a0302174ed
Instruction ID: 8ec68ccab3fdb09e525879fe6b2d37b9869cafd00d8d68aa07f2338666eb11f4
Opcode Fuzzy Hash: dfead87ec6108077648ad3825d3ea0080477edc8ca47081f20bdd0a0302174ed
Instruction Fuzzy Hash: 79E1DD63B35A4696DB14AF64E918AB8A3A0EF087E4FC04736D93D47BD8DE28D019C311

Function 00007FF77C313500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF77C3135A0
RaiseFailFastException.KERNEL32 ref: 00007FF77C3136A9
RaiseFailFastException.KERNEL32 ref: 00007FF77C3136E6

Strings

Process is terminating due to StackOverflowException., xrefs: 00007FF77C31358A

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction ID: 7795cfc6d3385259c83c144c80ce5ec5afb207dcbca74ed5d98bbae205775b14
Opcode Fuzzy Hash: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction Fuzzy Hash: 88519423B39E468BEF90AB15D4817B8A390EF4CB94F94483ADA1E47790DF2DE455C321

Function 00007FF77C352DC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00000286DEC00000,00007FF77C352EBD,?,?,00000000,00007FF77C33F8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF77C32945C), ref: 00007FF77C352E12
GetProcAddress.KERNEL32(?,?,?,?,00000286DEC00000,00007FF77C352EBD,?,?,00000000,00007FF77C33F8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF77C32945C), ref: 00007FF77C352E2C

Strings

GetEnabledXStateFeatures, xrefs: 00007FF77C352E22
kernel32.dll, xrefs: 00007FF77C352DFD

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 2574300362-4754247
Opcode ID: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction ID: 906063c229314de1bc5b24c8c229e06741ce6002f15a0da040cb769efdfd22ac
Opcode Fuzzy Hash: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction Fuzzy Hash: F5210F53F3C14242FFA8A339F455F7996818B1C394FC8803ECA0EC1A94DD1EE8804221

Function 00007FF77C31AF90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF77C3153FB), ref: 00007FF77C31AFA3
GetProcAddress.KERNEL32(?,?,?,?,00007FF77C3153FB), ref: 00007FF77C31AFB8

Strings

kernel32, xrefs: 00007FF77C31AF96
GetEnabledXStateFeatures, xrefs: 00007FF77C31AFAE

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction ID: 991c006fc99a4d411f56a9e71e422e824bec9480308e2955ba8c73f741958777
Opcode Fuzzy Hash: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction Fuzzy Hash: 85E04F16F36B0282EF45B753988166497A06F4C745FC84438C91D01394EE2CA6599731

Function 00007FF77C31AFE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF77C315376), ref: 00007FF77C31AFF3
GetProcAddress.KERNEL32(?,?,?,?,00007FF77C315376), ref: 00007FF77C31B008

Strings

kernel32, xrefs: 00007FF77C31AFE6
GetEnabledXStateFeatures, xrefs: 00007FF77C31AFFE

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction ID: 14211bb23dd96cb982dea3db33a368054ad5901fa90ddbb5cdc1a8021c42c1bd
Opcode Fuzzy Hash: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction Fuzzy Hash: C6E02656F3AA0286FF49BB1298813B083A06FAC704FC8443CC90D013A1EE3CE24A9321

Function 00007FF77C34E700 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF77C34E77B
SwitchToThread.KERNEL32 ref: 00007FF77C34E819
SwitchToThread.KERNEL32 ref: 00007FF77C34E82E

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction ID: fad4d8f43757c7cfbab4aa3a23281ab1062acaaedaa77607f684f508a2c9ac42
Opcode Fuzzy Hash: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction Fuzzy Hash: 5C41D733A3865681EF64AB25D84093DE690EF0CFA4F94873ED65E4A7C5CE2CE5408762

Function 00007FF77C3319FD Relevance: 6.1, APIs: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF77C331B22
SwitchToThread.KERNEL32 ref: 00007FF77C331DAE

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction ID: c19ed9d7f2143ee0ab40ede7ab42a240e91cdd4ed66bce1ef45235e44deaba65
Opcode Fuzzy Hash: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction Fuzzy Hash: 9B513A23E382034BFB55BB299945F75F3A4AF0D740F94453CE90D862E1EE2DB8408632

Function 00007FF77C34EE70 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF77C34EF49
DebugBreak.KERNEL32 ref: 00007FF77C34EF66
DebugBreak.KERNEL32 ref: 00007FF77C34EF81
DebugBreak.KERNEL32 ref: 00007FF77C34EF9A

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction ID: f381f75b0c5466b407bf83d470298c1bf9a9fe633b23dd71f6c5fbd34abe119e
Opcode Fuzzy Hash: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction Fuzzy Hash: 1541B523A3968182FB516B119540B79E7A0EF4CB54F8A063CDE4D1B395DF3CE581C322

Function 00007FF77C33D010 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF77C33D0C9
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF77C33D0E6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF77C33D106
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF77C33D129

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction ID: 12062844f9eea2f03e4c2b0f1f67f2e3e293fb642bb97ef4d7175a022181afa2
Opcode Fuzzy Hash: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction Fuzzy Hash: B2319163A3974282EB647F11A5407B9E7A4EF4CB94F98003CDE4D07799DE3CE8418722

Function 00007FF77C31AB10 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C316291), ref: 00007FF77C31AB44
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C316291), ref: 00007FF77C31AB4E
CoWaitForMultipleHandles.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C316291), ref: 00007FF77C31AB6D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C316291), ref: 00007FF77C31AB81

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction ID: d7fba1b54e975f577b1c84b964d2cc50ae6bf335bef30af171e52e6cd537af50
Opcode Fuzzy Hash: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction Fuzzy Hash: 2811E972B3CA9687DB149B16B80042AF3A1FF48B95F944539EADE83BA4CF3CD5008700

Function 00007FF77C3792DC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF77C379308
GetCurrentThreadId.KERNEL32 ref: 00007FF77C379316
GetCurrentProcessId.KERNEL32 ref: 00007FF77C379322
QueryPerformanceCounter.KERNEL32 ref: 00007FF77C379332

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction ID: ceb69275aabca369384c0757325c6eb564362f7e6391d0a2941e1009dd451ff6
Opcode Fuzzy Hash: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction Fuzzy Hash: 1C112E22B25F0689EB00DF71E8552B873A4FB1DB58F840E35DE6D867A4DF78D1948350

Function 00007FF77C37A65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C3797EB), ref: 00007FF77C37A6AC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF77C3797EB), ref: 00007FF77C37A6ED

Strings

csm, xrefs: 00007FF77C37A6DA

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction ID: f7af4c8fda28335900b76765556f933b02150b41986756b809927bfcf2c537e2
Opcode Fuzzy Hash: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction Fuzzy Hash: 60115B32629B4182EB219B15F540269B7E0FB89B98F985235DA8D07764DF3CD5518B00

Function 00007FF77C333C20 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF77C333D9F,?,?,?,00007FF77C34006A), ref: 00007FF77C333C6A
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF77C333D9F,?,?,?,00007FF77C34006A), ref: 00007FF77C333CAC
EnterCriticalSection.KERNEL32(?,?,00000000,00007FF77C333D9F,?,?,?,00007FF77C34006A), ref: 00007FF77C333CD7
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF77C333D9F,?,?,?,00007FF77C34006A), ref: 00007FF77C333CF8

Memory Dump Source

Source File: 00000000.00000002.1991683904.00007FF77C311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C310000, based on PE: true

Associated: 00000000.00000002.1991668295.00007FF77C310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991858132.00007FF77C43D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992227700.00007FF77C48D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C50A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992317171.00007FF77C510000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1992373539.00007FF77C518000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c310000_T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U01.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 045b48fe72bcf7abecfebc8b7f0e13c8ed7eea996b5e53e3f88679adc4f03f51
Instruction ID: 579fa56f6053ef62264e441158e78bb62863e08f1107021ff77e3ce067773c14
Opcode Fuzzy Hash: 045b48fe72bcf7abecfebc8b7f0e13c8ed7eea996b5e53e3f88679adc4f03f51
Instruction Fuzzy Hash: 3E214123A7890792EB50FB14E8697B4B294FF183A0FE80639C42D419E5DF6DE555C321

Analysis Process: jsc.exePID: 6368, Parent PID: 6548COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	2

Executed Functions

Function 01769BE2 Relevance: 2.7, Instructions: 2738COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897f001f315d19fdcfaeca011f1d0d9441b23f91c27ebe8793c5085f9b7a7d6d
Instruction ID: 098ee49fdc99f652a40384f6192bd7dadbb67f5fcd005993f7fd4ac6ca3ea648
Opcode Fuzzy Hash: 897f001f315d19fdcfaeca011f1d0d9441b23f91c27ebe8793c5085f9b7a7d6d
Instruction Fuzzy Hash: 3753E731D10B1A8ACB51EF68C8805ADF7B1FF99300F15D79AE4587B121EB70AAD5CB81

Function 0176CDA8 Relevance: 2.3, Instructions: 2293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a01e6280dc4034479dc8b952bcd4a65eb276334391662d52f0c1e9b56bdc64
Instruction ID: 6cd0712f901cff4c473f3a47fdc687ad8c3107ac50cf0c3cec757ff714320162
Opcode Fuzzy Hash: 43a01e6280dc4034479dc8b952bcd4a65eb276334391662d52f0c1e9b56bdc64
Instruction Fuzzy Hash: 5B332F31D1071A8EDB11EF68C8946ADF7B5FF99300F15C79AE448A7211EB70AAC5CB81

Function 01763E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 017640CB

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 475ed05ec6fe9bc7135ae790d23cb4ee02270c3255ef59b867e4439202973ca1
Instruction ID: e9fad95bcba8d89ecd6046b094756389973858167676e2a8525ee90aee4befb5
Opcode Fuzzy Hash: 475ed05ec6fe9bc7135ae790d23cb4ee02270c3255ef59b867e4439202973ca1
Instruction Fuzzy Hash: 0B913970E00219DFDB14CFA9C9857DEFBF6BF88314F148129E819A7254EB749886CB81

Function 01764A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ed2e7d8c3b2071be7bb1ed25c28af5d0770e6d5ea0e7a4cae6200d0b91d123
Instruction ID: 53931e641204e2d3e886ed702d5fe10bdb1c1dd948f3d4cb7e69a84b35faa91d
Opcode Fuzzy Hash: 22ed2e7d8c3b2071be7bb1ed25c28af5d0770e6d5ea0e7a4cae6200d0b91d123
Instruction Fuzzy Hash: 02B14C70E00209DFDF14CFA9C9857ADFBF6AF88314F188529D91AA7354EB749885CB81

Function 0652E337 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0652E2F7

Strings

Te]q, xrefs: 0652E46A

Memory Dump Source

Source File: 00000003.00000002.3234926050.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6520000_jsc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: Te]q
API String ID: 1890195054-52440209
Opcode ID: 32570a6cb17b0469a4b1ddfc730d8a31fd03e14ff7b6193b1ba7eb34b7d66b44
Instruction ID: 9299c85bde5f8ec980402b5998d65852347548d41f3cd06537f50f292af79b09
Opcode Fuzzy Hash: 32570a6cb17b0469a4b1ddfc730d8a31fd03e14ff7b6193b1ba7eb34b7d66b44
Instruction Fuzzy Hash: 4C51D031E102659FDF20CB68D845BAD77A1FB8A310F248429E409EB391CA79AC46CFD1

Function 01764804 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 017649D2
\Vl, xrefs: 0176487F

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 96e02fe2b9bc55a0ace665ad0a76dcb5d6b6d4f62a2f173d76dfe227c1a26443
Instruction ID: f1ad64567f5b9871263ce95f909255d717e4c36a53fbab8c15349c6320d76ca3
Opcode Fuzzy Hash: 96e02fe2b9bc55a0ace665ad0a76dcb5d6b6d4f62a2f173d76dfe227c1a26443
Instruction Fuzzy Hash: 2F718AB0E00209DFDB10DFA9C98579EFBF6AF48314F148129E81AA7254EB749846CB95

Function 01764810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 017649D2
\Vl, xrefs: 0176487F

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 08751ed3df53a0bbe39cb033818033bbeffaf4f5344decfcf7ac2f56592da77b
Instruction ID: 2bbdedbe2510f01cd390900b1b3711f968445fad34a647997cce437f119398ce
Opcode Fuzzy Hash: 08751ed3df53a0bbe39cb033818033bbeffaf4f5344decfcf7ac2f56592da77b
Instruction Fuzzy Hash: 1E719CB0E00209DFDF14DFA9C88579EFBF6BF88314F148129E81AA7254EB749845CB85

Function 01766ED7 Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 01766FA6
LR]q, xrefs: 01766F0E

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: fdd2e02176bd4ca47adecdacda033c2062bddf8e5c20c652f56446d68a90c94c
Instruction ID: f1382799294e58801e5c5d6cc90a766a34e9de107549f989abf105d53b82b9b3
Opcode Fuzzy Hash: fdd2e02176bd4ca47adecdacda033c2062bddf8e5c20c652f56446d68a90c94c
Instruction Fuzzy Hash: 3251E130E10209DFDB19DF78C4547AEB7B6EF85304F60852AE806EB291DB719C46CB91

Function 0652E290 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0652E2F7

Memory Dump Source

Source File: 00000003.00000002.3234926050.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6520000_jsc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 49ca5a763c7a5665eaca011cde303ea9f17f535b9746719c1badf50fc49456e1
Instruction ID: cdb2b58770e362f04cff914b47e352561bc79a286482478a52ce34da1cad5e2d
Opcode Fuzzy Hash: 49ca5a763c7a5665eaca011cde303ea9f17f535b9746719c1badf50fc49456e1
Instruction Fuzzy Hash: 841112B1C0066A9BCB10DF9AD544B9EFBF4FF49320F14812AD918A7240D378A944CFE5

Function 01763E74 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

\Vl, xrefs: 017640CB

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 0fba1623c3c907ab78f7ab52fdb8a353c62e81a850d7de51a0320961704556bd
Instruction ID: 8224dded00359b849c3861a71c20538afd29d42f28fde8a335e35cd6c6a20591
Opcode Fuzzy Hash: 0fba1623c3c907ab78f7ab52fdb8a353c62e81a850d7de51a0320961704556bd
Instruction Fuzzy Hash: 33916B70E00209DFDB14CFA8C9857DDFBF6BF88304F148129E819A7254EB749886CB81

Function 0176F2CD Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0176F41B

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ad9eea2972b3d93eaadcc0b8a71c95983472a0e7fa5b9a7612c8eea66a834400
Instruction ID: ee678641d910ec117823314eb236c5115cc52512fda51f42475797b98f318606
Opcode Fuzzy Hash: ad9eea2972b3d93eaadcc0b8a71c95983472a0e7fa5b9a7612c8eea66a834400
Instruction Fuzzy Hash: 42410230B002018FDB259B38E56466EBBEBEF85250F148578D806DB395DE39DC06CBA5

Function 01766F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01766FA6

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 2ae509f17fdd90f08fd68104495cd79ff460e73187ccb16ebf09c7eeb85a3605
Instruction ID: 1c8cf71aa3654df439a650f5bd6ca36a77d86897f3cd9e96138d1e31a7bbffb7
Opcode Fuzzy Hash: 2ae509f17fdd90f08fd68104495cd79ff460e73187ccb16ebf09c7eeb85a3605
Instruction Fuzzy Hash: 97316F34E10209DBDB19CF68D44079EF7B6EF89354F60852AE905FB241EB71A842CB51

Function 01766B90 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01766BD7

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 9d0ec15b46375fe97a6c67bbc528911ab245071d5d9311f88e5e803ba1f0b960
Instruction ID: ef64471c4e11956a02c20bf71fd0950aaf3739d3c4216ef5354ed2b45e9e44f7
Opcode Fuzzy Hash: 9d0ec15b46375fe97a6c67bbc528911ab245071d5d9311f88e5e803ba1f0b960
Instruction Fuzzy Hash: E32105316192918FC712EF7CD4A479EBFB6EF96200F0448AED049CB29ADA359C49C791

Function 01767908 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db16fe82026267608c89feab5c0d30e46d14b99579bd83c7c3d889b420292e8d
Instruction ID: f439bed179919b265722d209be601a58986a4dc4171d4310b420079ca4cb464c
Opcode Fuzzy Hash: db16fe82026267608c89feab5c0d30e46d14b99579bd83c7c3d889b420292e8d
Instruction Fuzzy Hash: 2E121E30720211DFCB1AAB3CE558628B7ABFBC9245B504939E405CB369DF75DC878BA1

Function 01769364 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9e197c95d1ca769dda0ae86312d7b143fc698db819c8d91978b6307f3150d9
Instruction ID: 9d174ffedf174231d078cf081825c01eda0dcb714d1506fce78d5dd401815c80
Opcode Fuzzy Hash: bf9e197c95d1ca769dda0ae86312d7b143fc698db819c8d91978b6307f3150d9
Instruction Fuzzy Hash: DED17D34B002058FDB15DF68D584AAEBBB6FF89314F24846AEA06DB395DB34DC42CB41

Function 017696E0 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54561fd65dabe122bc1e4513e238f239770f242505f2b5792a0f5814b4e4f44d
Instruction ID: d84bdb2f6f0175f2e91b15d6c6b46f5037a5488795c7085eea8a133c5c8c82e6
Opcode Fuzzy Hash: 54561fd65dabe122bc1e4513e238f239770f242505f2b5792a0f5814b4e4f44d
Instruction Fuzzy Hash: BFC1AF30B002068FDB15CF68D9847AEFBB6FB84314F20856AEA09DB395DB74D945CB91

Function 01764A8C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4f3d59f9ed9badc847bcf70e60de9a3d248113cefd4fb785b7edd96ebd604c
Instruction ID: 7543148b45012e2eab52ecd9a17344557944ae52b77fafdf2938b94bd3ceaa91
Opcode Fuzzy Hash: 4e4f3d59f9ed9badc847bcf70e60de9a3d248113cefd4fb785b7edd96ebd604c
Instruction Fuzzy Hash: 2DA14A70E00209DFDB10CFA9D9857ADFBF5AF88314F188529D91AA7354EB749885CB81

Function 01766CDD Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afe5f0401fbdf92d90c6230459ed84a0833f4d3e4e8961a20103050c6c7bb71
Instruction ID: 307af85c61170ca68ec540871e2649df08af07fdbdfe67aa24b04102a7ac3d25
Opcode Fuzzy Hash: 2afe5f0401fbdf92d90c6230459ed84a0833f4d3e4e8961a20103050c6c7bb71
Instruction Fuzzy Hash: BE510270D002188FDB18CFA9C884BADFBB5BF48714F548129E819BB395D774A885CF95

Function 01766CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e927c68c0d4a41b98fea91eaadcbf925d74014bc60bbd9f8d98b93fda37283a4
Instruction ID: 2e5989eab8a66414704bd93801f1ebec688cccb8b009ef7a1668b906890aa0c7
Opcode Fuzzy Hash: e927c68c0d4a41b98fea91eaadcbf925d74014bc60bbd9f8d98b93fda37283a4
Instruction Fuzzy Hash: 77510370D002188FDB18CFA9C884B9DFBB5FF48714F548529E819BB391D774A885CB95

Function 0176112A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da269c146b002d63d183f9a21d2c937eb3ec4ccd0e1d6fa25cb89ae7a767f4d4
Instruction ID: 39e88bb84c71c65b116028a62b2cbca3b99b3ba7e4aa13a9e715e5badfb150d7
Opcode Fuzzy Hash: da269c146b002d63d183f9a21d2c937eb3ec4ccd0e1d6fa25cb89ae7a767f4d4
Instruction Fuzzy Hash: 5851EA78302141CFCB19DF2DF9889447F7AFBD639470081A9E0455B23ADB286D09DFA2

Function 01761138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640c4d212cbb6650eb4a4a0a588ba76c2b64eb5673b258b0b843e457d29f9ab2
Instruction ID: fa7bdfa3fadbe398d18768868a3a3ffd5e0dd821672fa0d29f726be30a4ecd47
Opcode Fuzzy Hash: 640c4d212cbb6650eb4a4a0a588ba76c2b64eb5673b258b0b843e457d29f9ab2
Instruction Fuzzy Hash: 1451C878302141CFCB19DF2DF9889487F7AFBD979430081A9E0455B23ADB286D09DFA2

Function 0176F190 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc1410318e6bd43d63791e262428912db1212d985367d11cc000deb17ca3bf5
Instruction ID: 46c0b528c4e4df5f7e33ad379ebe4210d60befaf08a743acab3edb8c87c2d030
Opcode Fuzzy Hash: 0bc1410318e6bd43d63791e262428912db1212d985367d11cc000deb17ca3bf5
Instruction Fuzzy Hash: C3316C79E142068BCB09CFA8E895A9EB7B6AF89300F10C529E805E7351DB30A842CF41

Function 0176F1A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef60713ac3b701237e1723ff856e44a257dbd067ddb1b9110371f66e74763ec
Instruction ID: 156337a41637fe319d012c0b891c3c55b33b81682eae36e170f82b2f1b32295c
Opcode Fuzzy Hash: 5ef60713ac3b701237e1723ff856e44a257dbd067ddb1b9110371f66e74763ec
Instruction Fuzzy Hash: C2316F39A106058FCB19CFA9E494A9EF7B6FF89300F10C529E805E7350DB70AC46CB40

Function 017626DE Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1e7dfaa8d53d3a714a2d98b50e8dd2612ef04f13a86c64d4227f4ec98e3a78
Instruction ID: d393054a18a077e3d7c8639e1e6b69f5a6a88f1141b4d3e8a131f94d04d645a7
Opcode Fuzzy Hash: ce1e7dfaa8d53d3a714a2d98b50e8dd2612ef04f13a86c64d4227f4ec98e3a78
Instruction Fuzzy Hash: 7B41E0B4D00249DFDB14DFA9C984ADEBFB5FF48310F14842AE809AB254DB75A949CB90

Function 017626E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fea63ee24bf306a6119d5879e2682f0d643c81e15a82b15dd0317c3d84c25cd
Instruction ID: a26f9662864f6c185dd365fd3f9e89c895bddca99a1eef9b117e95b2042c619d
Opcode Fuzzy Hash: 2fea63ee24bf306a6119d5879e2682f0d643c81e15a82b15dd0317c3d84c25cd
Instruction Fuzzy Hash: 6A41EEB0D002499FDB14DFA9C884ADEBFB5FF48310F148429E909AB254DB75A945CB90

Function 01769250 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15278e8d6620a0f3791c2b6b7e30b262c52f7e94659980836b0fc1b363d75777
Instruction ID: 814924eaba115fec1397b06ca905d9f9022d7df7a7b60918337545f1fb458b63
Opcode Fuzzy Hash: 15278e8d6620a0f3791c2b6b7e30b262c52f7e94659980836b0fc1b363d75777
Instruction Fuzzy Hash: C631B171E002099FCB05CFA9D494A9EFBB6FF89304F14C619E905EB341DB709886CB91

Function 01769260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ba0d0ef474b517f8c5e5f61a7b1fd7502b7b7e715620fc97202d99a0a9617b
Instruction ID: a3b3060d29237bf61455195eb2b241b5b5b5c2312ae89191eb7865975a5b6ea2
Opcode Fuzzy Hash: e6ba0d0ef474b517f8c5e5f61a7b1fd7502b7b7e715620fc97202d99a0a9617b
Instruction Fuzzy Hash: FD218231E0020A9FDF05CFA9D49469EFBB6FF89304F54C519E905EB241DB709886CB91

Function 01769150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b659148f983b582fd64309d859eb7c55632288934b64a65a70790171f42de4
Instruction ID: 488fdfe52ab67c07a7ef4727ea9997e5a4147316613b0f87fd615c8a5ce1bc95
Opcode Fuzzy Hash: 65b659148f983b582fd64309d859eb7c55632288934b64a65a70790171f42de4
Instruction Fuzzy Hash: D6218D31E04605CFCB19CFA8C844A9EF7B6AF89304F20861AED16A7341DB70A946CB51

Function 0176169F Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb2ff793f5bc14aef236eca4e77591931f21d36e1cb46a1e1fe24b2244aedf6
Instruction ID: 689b808ed33f3074eb5caa2544f02157ca5018b9070a89e9979553e6d8fb735b
Opcode Fuzzy Hash: 7bb2ff793f5bc14aef236eca4e77591931f21d36e1cb46a1e1fe24b2244aedf6
Instruction Fuzzy Hash: 0A214F787001014FDB26EB3CF88CB597B69EBC9355F504965D806CB26ADB2CDC45CBA2

Function 0171D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233181346.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_171d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c32ea1f7b3d8e47105983c0aca5281c5ecf84f0125df352680981c4cb58201
Instruction ID: 2001e8b4f01af7a39f1e8a81d4a120f7a2f85c5329357c8a0dc2829e55d34cb4
Opcode Fuzzy Hash: e9c32ea1f7b3d8e47105983c0aca5281c5ecf84f0125df352680981c4cb58201
Instruction Fuzzy Hash: 85212271504204DFCB25DF9CD9C8B26FBA5FB88314F20C6ADD9090B25AC33AD846CA62

Function 01761878 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f293c5d94c7ee527eb5b8a918998fca4eed99ccc8d64e624723b455ae3aabc9
Instruction ID: c830dd799acdf91c78d279771332d408927be21802394897e664dbd3df577c02
Opcode Fuzzy Hash: 8f293c5d94c7ee527eb5b8a918998fca4eed99ccc8d64e624723b455ae3aabc9
Instruction Fuzzy Hash: 87217C30B00255CFDB25DB78C6597ADBBF9AB89340F5004A9D805EB254DB368D05DB61

Function 01764F8A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31775bd9f327ed25cab4d7cbd2358b0dfadfbb9bd960b60052efdcb601c93519
Instruction ID: c04642e17b086a2a60816bbddd27ef28f564930334ecbb6e463a4edb6ba2de0c
Opcode Fuzzy Hash: 31775bd9f327ed25cab4d7cbd2358b0dfadfbb9bd960b60052efdcb601c93519
Instruction Fuzzy Hash: A6214834B00104CFDB24DF78D558AADBBF5EB89340B2045A8E806EB365DB36DC05DBA1

Function 01769160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8bd21f7cf85e5fa6eddbcd69e9db4c267ea4988039259c1b715fe54e9ad59c
Instruction ID: 70ab5b7a8773e9d368f6e308057c898bf1c01696c91dae744cf4d2ffe20db046
Opcode Fuzzy Hash: 0c8bd21f7cf85e5fa6eddbcd69e9db4c267ea4988039259c1b715fe54e9ad59c
Instruction Fuzzy Hash: 36217F30E0460ADFCB19CFA5D85459EF7B6AF89304F20C52AED15BB340DB709946CB51

Function 01761888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c9c92eb588aad89d1e80884bf25a4f11e279c70ed6fae0e77069ed427a8ee9
Instruction ID: 3e6147466e1a5e3afd8d8439487f44cc8064a3a9116bacaf036def486d0ba3e2
Opcode Fuzzy Hash: d4c9c92eb588aad89d1e80884bf25a4f11e279c70ed6fae0e77069ed427a8ee9
Instruction Fuzzy Hash: 20216030B00245CFDB14EB78C5196ADB7F9EF89340F9004A9D905EB354DB358D04DBA1

Function 017616B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1969c206c172de41e4648ee8ebf298c0a3fdcc2860f55101156e49b517f12be
Instruction ID: d99c5688f854df13f93060c9c5f106f0f37795edb85a8621bf6e55a500337cb3
Opcode Fuzzy Hash: c1969c206c172de41e4648ee8ebf298c0a3fdcc2860f55101156e49b517f12be
Instruction Fuzzy Hash: 10214F787101014FDB25EB2CF88CB59B76EEBC8354F504925D806C7266DB2CDC45CB91

Function 01761382 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f351dee141a3f74425835b1d141de47e3f7aee0b683738778685b00e9be09906
Instruction ID: dfd2cae286a2af99663367286e3918db24facde9c672bb2ea367abcc46d73ba5
Opcode Fuzzy Hash: f351dee141a3f74425835b1d141de47e3f7aee0b683738778685b00e9be09906
Instruction Fuzzy Hash: 66217F70B102418FDB3AA72CE59C328BF69E78A315F500869D807C73C5DB69CC84CB92

Function 01764F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03b530f36ff88e4e80a975a3662955b4228f8abd8dc48638a4885c3daa5ce95
Instruction ID: 35d39a8ba8b2a2db22a5d691c0d12e98fc0c1fd09dfbd74c64a4e8492f9a098e
Opcode Fuzzy Hash: f03b530f36ff88e4e80a975a3662955b4228f8abd8dc48638a4885c3daa5ce95
Instruction Fuzzy Hash: E1211634700205CFDB24DF79D558AADBBF5EB89350B1044A8E806EB3A5DB36DD01DBA1

Function 01760848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45db5395ec1c5bda1c894401d214e282864de135ec94b858bb9ec33fb0c5ee6b
Instruction ID: 64984754fec311216b55cdd0ce5157308f747e7c41839f324e811edb49c0bdd8
Opcode Fuzzy Hash: 45db5395ec1c5bda1c894401d214e282864de135ec94b858bb9ec33fb0c5ee6b
Instruction Fuzzy Hash: 3F119130B802058FDF66DB7DD44872EB6AEEB85250F104979F806CB292DA69CC858BD1

Function 01760838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71a7b544a7ddd1f0e0acbffc40cde662389453cfee80db74264325e7945153c
Instruction ID: afc026082ceadaf479dde4a984cdeafa455b2f17d5cbd45f769c62db763953ac
Opcode Fuzzy Hash: a71a7b544a7ddd1f0e0acbffc40cde662389453cfee80db74264325e7945153c
Instruction Fuzzy Hash: C111A330B403065BEF26DA7DD40436DF65DEB46250F144979FC06CB282DA69CD454BD1

Function 01761488 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8766b2e7ee8f80877155b5a3138928418a465b65b92e33d62ea892712690ebe
Instruction ID: bf9c0b1efa2155be3664fc4ac5ab9be5f1661d5946a74237c4788e47613d3176
Opcode Fuzzy Hash: e8766b2e7ee8f80877155b5a3138928418a465b65b92e33d62ea892712690ebe
Instruction Fuzzy Hash: 55117071E002158FCF26EFB884486AEFBB9AF98210B650479EC05E7306E635D9418B91

Function 017617C2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0363572e9405f941171a2e8d7b373fbcc016171a4cbc4076cfe4555b0a1c01d1
Instruction ID: 44b4248eafe456786ba4688128935795dc9e71b5e0b8f708aa83d3fd2bc980a3
Opcode Fuzzy Hash: 0363572e9405f941171a2e8d7b373fbcc016171a4cbc4076cfe4555b0a1c01d1
Instruction Fuzzy Hash: A811C275B002119FCB10ABB9A84865EBFE9EBCD750F104465E909D3344EA389D4187A2

Function 0171D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233181346.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_171d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: a44ab25e6cce57fb374d85f7fd9fb37c04b16543262247654d0cc523699510c7
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 2211BE75504284CFDB22CF58D5C4B15FF61FB84314F24C6AAD8494B656C33AD44ACF62

Function 01761498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a829431d5dbf6498b902aad1572b567e848f3fb30bed9f86b5c25b89c4050839
Instruction ID: 0beb36a75b1ee1bded28451329b7dffd66439b23b6cfdcd22c4f9220deae04c6
Opcode Fuzzy Hash: a829431d5dbf6498b902aad1572b567e848f3fb30bed9f86b5c25b89c4050839
Instruction Fuzzy Hash: 9E014431A002159FCB26EFB8845859EFBF9EF98210F650479EC05E7305E775D9418B91

Function 017680F1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2604f452497d2be3da0078e0920c825a400ae42b3f85ebe86fa08bd7e747f4b6
Instruction ID: e6ccb32d93c6559dfe112aa4fcdf430227290d81688098035f8d3cab9062a673
Opcode Fuzzy Hash: 2604f452497d2be3da0078e0920c825a400ae42b3f85ebe86fa08bd7e747f4b6
Instruction Fuzzy Hash: 5B018430A40209DFCB05EFBCF98594C7BF9EF85344B5041B8C4049B265DB346E49CB51

Function 01767090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f090ede702b69a08303168e9f21fb1a5f532f1b6badc9a25e7429a1ca8b326
Instruction ID: 26e0b58864860093c27700217a68ef120a7aaaf69d8407dbf1771a5793fc8e94
Opcode Fuzzy Hash: e5f090ede702b69a08303168e9f21fb1a5f532f1b6badc9a25e7429a1ca8b326
Instruction Fuzzy Hash: 0DF0C439B10218CFC718EB68D598A6DB7B2EF88359F1140A8E5069B3A4CB35AD42CF51

Function 01768100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3233316902.0000000001760000.00000040.00000800.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1760000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265f8def5efd498fe95a26b04029526e88324a3939270600472f28ee350580bf
Instruction ID: c56b8601801a753fceaf7add6fb4cf967fd16de0e427304461ec3c481a9fbf23
Opcode Fuzzy Hash: 265f8def5efd498fe95a26b04029526e88324a3939270600472f28ee350580bf
Instruction Fuzzy Hash: DDF01D34A40109DFCB05EFBCF98999D7BBAEF84244F504278C4089B254DB356E49CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

C:\Users\user\T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
T#U00dcB#U0130TAK SAGE TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 sxlx..exe

Function 00007FF77C3224C0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Function 00007FF77C3155C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Function 00007FF77C328F50 Relevance: 2.9, Strings: 2, Instructions: 421
COMMON

Function 00007FF77C322070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Function 00007FF77C31AE30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Function 00007FF77C316480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Function 00007FF77C31B130 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Function 00007FF77C321E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Function 00007FF77C341470 Relevance: 5.1, APIs: 4, Instructions: 112
COMMON

Function 00007FF77C3502E0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Function 00007FF77C32CD40 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Function 00007FF77C322740 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Function 00007FF77C319D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Function 00007FF77C378D70 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre