Edit tour

Windows Analysis Report
lYWiDKe1In.exe

Overview

General Information

Sample name:	lYWiDKe1In.exe renamed because original name is a hash value
Original sample name:	985584f5b7be5d605c1264624f4bd68e.exe
Analysis ID:	1457173
MD5:	985584f5b7be5d605c1264624f4bd68e
SHA1:	8efbf3680021b3fb3b68094ee5296dcabb5abc1a
SHA256:	5496d968b378eef69af5eb89159bc728b8ad9e395e42c74f788a4b7a8ec8a7bd
Tags:	32exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

lYWiDKe1In.exe (PID: 3572 cmdline: "C:\Users\user\Desktop\lYWiDKe1In.exe" MD5: 985584F5B7BE5D605C1264624F4BD68E)

cmd.exe (PID: 1716 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djiglggs\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6200 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe" C:\Windows\SysWOW64\djiglggs\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3636 cmdline: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5244 cmdline: "C:\Windows\System32\sc.exe" description djiglggs "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 6336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3608 cmdline: "C:\Windows\System32\sc.exe" start djiglggs MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7124 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3364 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028 MD5: C31336C1EFC2CCB44B4326EA793040F2)

bvvnqaeq.exe (PID: 1772 cmdline: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d"C:\Users\user\Desktop\lYWiDKe1In.exe" MD5: DEA876A83A60426A2C1F32D0E6A77799)

svchost.exe (PID: 5532 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 3560 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 536 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3624 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5352 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4372 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1772 -ip 1772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 4292 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4bb0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4900:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: lYWiDKe1In.exe PID: 3572	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: bvvnqaeq.exe PID: 1772	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 5532	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.lYWiDKe1In.exe.6e0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.lYWiDKe1In.exe.6e0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.3.bvvnqaeq.exe.5e0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.bvvnqaeq.exe.5e0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.lYWiDKe1In.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.lYWiDKe1In.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.lYWiDKe1In.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bvvnqaeq.exe.5c0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.5c0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
17.2.svchost.exe.2cb0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.2cb0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.2cb0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bvvnqaeq.exe.5e0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bvvnqaeq.exe.5e0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.5e0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
17.2.svchost.exe.2cb0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.2cb0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.2cb0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bvvnqaeq.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bvvnqaeq.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.lYWiDKe1In.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bvvnqaeq.exe.5e0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.lYWiDKe1In.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.5e0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.5e0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.lYWiDKe1In.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.lYWiDKe1In.exe.900000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.lYWiDKe1In.exe.900000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.3.bvvnqaeq.exe.5e0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.bvvnqaeq.exe.5e0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.bvvnqaeq.exe.5e0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bvvnqaeq.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bvvnqaeq.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bvvnqaeq.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.lYWiDKe1In.exe.900000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.lYWiDKe1In.exe.900000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.lYWiDKe1In.exe.900000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d"C:\Users\user\Desktop\lYWiDKe1In.exe", ParentImage: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, ParentProcessId: 1772, ParentProcessName: bvvnqaeq.exe, ProcessCommandLine: svchost.exe, ProcessId: 5532, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\lYWiDKe1In.exe", ParentImage: C:\Users\user\Desktop\lYWiDKe1In.exe, ParentProcessId: 3572, ParentProcessName: lYWiDKe1In.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 3636, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.40.26, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 5532, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d"C:\Users\user\Desktop\lYWiDKe1In.exe", ParentImage: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, ParentProcessId: 1772, ParentProcessName: bvvnqaeq.exe, ProcessCommandLine: svchost.exe, ProcessId: 5532, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 5532, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\djiglggs

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\lYWiDKe1In.exe", ParentImage: C:\Users\user\Desktop\lYWiDKe1In.exe, ParentProcessId: 3572, ParentProcessName: lYWiDKe1In.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 3636, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3624, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lYWiDKe1In.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Found malware configuration

Source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn	Virustotal: Detection: 14%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: lYWiDKe1In.exe

Virustotal: Detection: 56%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: lYWiDKe1In.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Unpacked PE file: 0.2.lYWiDKe1In.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Unpacked PE file: 12.2.bvvnqaeq.exe.400000.0.unpack

Source: lYWiDKe1In.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\djiglggs

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.76.228.127 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.40.26 52.101.40.26
Source: Joe Sandbox View	IP Address: 98.136.96.91 98.136.96.91
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 52.101.40.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.5:64298 -> 64.233.184.26:25
Source: global traffic	TCP traffic: 192.168.2.5:64300 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64301
Source: unknown	Network traffic detected: HTTP traffic on port 64301 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lYWiDKe1In.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bvvnqaeq.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5532, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.lYWiDKe1In.exe.6e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.bvvnqaeq.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.bvvnqaeq.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bvvnqaeq.exe.5c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.5c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.lYWiDKe1In.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.lYWiDKe1In.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\djiglggs\

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CBC913	17_2_02CBC913

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: String function: 006E27AB appears 35 times
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572

Source: lYWiDKe1In.exe, 00000000.00000002.2038665427.0000000000432000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesasdf* vs lYWiDKe1In.exe
Source: lYWiDKe1In.exe, 00000000.00000002.2039171400.0000000000728000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesasdf* vs lYWiDKe1In.exe
Source: lYWiDKe1In.exe	Binary or memory string: OriginalFilenamesasdf* vs lYWiDKe1In.exe

Source: lYWiDKe1In.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.lYWiDKe1In.exe.6e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.bvvnqaeq.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.bvvnqaeq.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bvvnqaeq.exe.5c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.5c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.lYWiDKe1In.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.lYWiDKe1In.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@11/5

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00717BDE CreateToolhelp32Snapshot,Module32First,

0_2_00717BDE

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CB9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_02CB9A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5352:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1868:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4372:64:WilError_03

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

File created: C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe

Jump to behavior

Source: lYWiDKe1In.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lYWiDKe1In.exe

Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

File read: C:\Users\user\Desktop\lYWiDKe1In.exe

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14821
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-14990

Source: unknown	Process created: C:\Users\user\Desktop\lYWiDKe1In.exe "C:\Users\user\Desktop\lYWiDKe1In.exe"
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djiglggs\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe" C:\Windows\SysWOW64\djiglggs\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description djiglggs "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start djiglggs
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d"C:\Users\user\Desktop\lYWiDKe1In.exe"
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1772 -ip 1772
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 536
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djiglggs\	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe" C:\Windows\SysWOW64\djiglggs\	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description djiglggs "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start djiglggs	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1772 -ip 1772	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 536	Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: lYWiDKe1In.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Unpacked PE file: 0.2.lYWiDKe1In.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Unpacked PE file: 12.2.bvvnqaeq.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Unpacked PE file: 0.2.lYWiDKe1In.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Unpacked PE file: 12.2.bvvnqaeq.exe.400000.0.unpack

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_0071AEC6 push 0000002Bh; iretd	0_2_0071AECC
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_00485C16 push 0000002Bh; iretd	12_2_00485C1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CC058F push esp; retf	17_2_02CC0592
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CC0548 push eax; retf	17_2_02CC054E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CC055B push eax; retf	17_2_02CC055E

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	File created: C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\djiglggs

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\lywidke1in.exe

Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

17_2_02CB199C

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15800
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_17-6538
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-15414

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_17-6241

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_17-7423
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15255
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15370

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-15007
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-15060
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_17-7520

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_17-6271
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14838
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_12-15005

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	API coverage: 5.0 %
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	API coverage: 3.8 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 1864	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1864	Thread sleep time: -36000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000011.00000002.3242542410.0000000003000000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~|

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	API call chain: ExitProcess graph end node			graph_0-15267
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_17-6273

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-16382
Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_17-7766

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_006E092B mov eax, dword ptr fs:[00000030h]	0_2_006E092B
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_006E0D90 mov eax, dword ptr fs:[00000030h]	0_2_006E0D90
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_007174BB push dword ptr fs:[00000030h]	0_2_007174BB
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_0048220B push dword ptr fs:[00000030h]	12_2_0048220B
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_005C092B mov eax, dword ptr fs:[00000030h]	12_2_005C092B
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_005C0D90 mov eax, dword ptr fs:[00000030h]	12_2_005C0D90

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CB9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_02CB9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.76.228.127 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2CB0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2CB0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2CB0000			Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2A1E008			Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djiglggs\	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe" C:\Windows\SysWOW64\djiglggs\	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description djiglggs "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start djiglggs	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1772 -ip 1772	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 536	Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

0_2_00407809

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\lYWiDKe1In.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lYWiDKe1In.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bvvnqaeq.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5532, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.5c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bvvnqaeq.exe.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bvvnqaeq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lYWiDKe1In.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lYWiDKe1In.exe.900000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lYWiDKe1In.exe PID: 3572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bvvnqaeq.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5532, type: MEMORYSTR

Source: C:\Users\user\Desktop\lYWiDKe1In.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02CB88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	17_2_02CB88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lYWiDKe1In.exe	57%	Virustotal		Browse
lYWiDKe1In.exe	100%	Avira	HEUR/AGEN.1310445
lYWiDKe1In.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta5.am0.yahoodns.net	0%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	15%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
google.com	1%	Virustotal	Browse
yahoo.com	1%	Virustotal	Browse
171.39.242.20.in-addr.arpa	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
jotunheim.name:443	13%	Virustotal		Browse
jotunheim.name:443	0%	Avira URL Cloud	safe
vanaheim.cn:443	0%	Avira URL Cloud	safe
vanaheim.cn:443	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	217.69.139.150	true	true	0%, Virustotal, Browse	unknown
mta5.am0.yahoodns.net	98.136.96.91	true	true	0%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.40.26	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	62.76.228.127	true	true	15%, Virustotal, Browse	unknown
smtp.google.com	64.233.184.26	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.40.26	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
64.233.184.26	smtp.google.com	United States	15169	GOOGLEUS	false
98.136.96.91	mta5.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
62.76.228.127	vanaheim.cn	Russian Federation	201211	DRUGOYTEL-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457173
Start date and time:	2024-06-14 11:19:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lYWiDKe1In.exe renamed because original name is a hash value
Original Sample Name:	985584f5b7be5d605c1264624f4bd68e.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@11/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.236.44.162, 20.76.201.171, 20.231.239.246, 20.70.246.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:20:39	API Interceptor	10x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.40.26	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.5284.17028.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.9178.5965.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.BotX-gen.15544.10747.exe	Get hash	malicious	Tofsee	Browse
98.136.96.91	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
	0bv3c9AqYs.exe	Get hash	malicious	Pushdo	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta5.am0.yahoodns.net	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	67.195.228.109
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.75
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.111
vanaheim.cn	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	file.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
microsoft-com.mail.protection.outlook.com	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	file.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.11.0
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
mxs.mail.ru	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.69.139.150
	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DRUGOYTEL-ASRU	http://students.humanconnections.com.au/Y0X.swf?8o542c!cbbbbxm0wqr!c!jtn1s!f40w2!dg!dbk!ck!hrx1b!5hb4!cbbcq4	Get hash	malicious	Unknown	Browse	62.76.228.2
	RSVAU8h96h	Get hash	malicious	Mirai	Browse	185.73.18.199
	LRLZJUXBPk	Get hash	malicious	Mirai	Browse	185.73.18.116
MAILRU-ASMailRuRU	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	5.61.23.11
	x64.nn.elf	Get hash	malicious	Mirai	Browse	128.140.169.91
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	uUyFtCTKDd.elf	Get hash	malicious	Mirai	Browse	94.100.184.243
	https://www.ixxin.cn/go.html?url=https://ok.me/b5SG1?M6bxrJ9vlWS?MtRgHryntBJ	Get hash	malicious	GRQ Scam	Browse	217.20.155.6
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	c40snYcuW6.elf	Get hash	malicious	Mirai	Browse	5.61.23.80
	arm7.elf	Get hash	malicious	Mirai	Browse	217.69.134.17
MICROSOFT-CORP-MSN-AS-BLOCKUS	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	20.199.87.174
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	20.199.87.174
	YoutubePlaylistDownloader.exe	Get hash	malicious	Unknown	Browse	52.168.117.169
	Report.eml	Get hash	malicious	Unknown	Browse	52.113.195.132
	Rolls-Royce WorkRequest.xls	Get hash	malicious	Unknown	Browse	52.113.195.132
	#U0625#U064a#U0635#U0627#U0644 #U0627#U0644#U062f#U0641#U0639.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.139.11
	t5SYVk0Tkt.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	20.23.140.143
	UDxMi3I3lO.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	20.23.140.143
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=8B8Q674nKweUpOPaXKM6VOMa9rVmT9F88gJKf7UnPIk7lVcTg1Q-V4IPa1qZ6xDW_Np8A6rXdvweyDFb4X_duRJq__NRXl8C6nr4Fp6_6jXTKY8i-eq9zaGF1nRMS5Naow-X8iPhCaW7gWnz15HywoXkRlBcF-HA5u9xlgwyXxJSOjg--X44rz6dyWRvR2kCcFbMVsikMsdWQtd8ernHlT8lEInagAkd6hInpq8HnR6qVnxsrq7Rp44guKAEXU6p35hzk1o7dqF0S746O9GWjNgbNSAsbClpjLwncPp2G24UeXuZxJpZDdiZxjV9eCg9jbcVC3za2iUP-qdmWbyOqIbtGcKK-4aGuNt5n-Ty9INr0JazCx6mCM_Aqb3V9vOzIhqqb3prxifizllceSNEbCM6OiMEWF8fLffrzjsUM-YjOjojHP7D4cEHhs3d2aEM0Aucrg	Get hash	malicious	HTMLPhisher	Browse	40.99.150.98
	https://code.jquery.com/jquery-3.6.0.min.js	Get hash	malicious	Unknown	Browse	52.109.76.240
YAHOO-NE1US	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.231.20
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	98.137.87.64
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	98.137.155.8
	P5uKPY120j.elf	Get hash	malicious	Mirai	Browse	216.252.107.75
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	98.137.155.8
	https://xsetlp3sattty7yhmls.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	74.6.231.20
	https://ioa.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2FpasswordIP:	Get hash	malicious	HTMLPhisher	Browse	74.6.231.18
	https://trhj.pages.dev/IP:	Get hash	malicious	HTMLPhisher	Browse	74.6.231.18
	K7HXpfSHdt.elf	Get hash	malicious	Mirai, Moobot	Browse	98.138.128.222

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe

Download File

Process:	C:\Users\user\Desktop\lYWiDKe1In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11102720
Entropy (8bit):	4.833656385413997
Encrypted:	false
SSDEEP:	196608:KaBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:zBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh
MD5:	DEA876A83A60426A2C1F32D0E6A77799
SHA1:	7CCAD1033B2948D9EBFE026E9C18F75D07835F5F
SHA-256:	0A75853AAB700610742D00E95AF8BC9B5BAF166535466B2757D01753A9BD6416
SHA-512:	ABAE7FCFF1AF67BB60C582E28857236AE845DAE49735D855F138AD481BD3326294E2CE1A2930EA1DE77C30242922A7DC910360B8173A446AEB1F4D165A65CD05
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..p...#...#...#u.\|#...#u.I#...#u.}#R..#..D#...#...#C..#u.x#...#u.M#...#u.J#...#Rich...#........PE..L...`..c.................r.........../............@.................................1].........................................(.... ...u..........................................................`...@...............L............................text...`q.......r.................. ..`.rdata..\%.......&...v..............@..@.data....W.......v..................@....rsrc....u... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11102720
Entropy (8bit):	4.833656385413997
Encrypted:	false
SSDEEP:	196608:KaBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:zBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBh
MD5:	DEA876A83A60426A2C1F32D0E6A77799
SHA1:	7CCAD1033B2948D9EBFE026E9C18F75D07835F5F
SHA-256:	0A75853AAB700610742D00E95AF8BC9B5BAF166535466B2757D01753A9BD6416
SHA-512:	ABAE7FCFF1AF67BB60C582E28857236AE845DAE49735D855F138AD481BD3326294E2CE1A2930EA1DE77C30242922A7DC910360B8173A446AEB1F4D165A65CD05
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..p...#...#...#u.\|#...#u.I#...#u.}#R..#..D#...#...#C..#u.x#...#u.M#...#u.J#...#Rich...#........PE..L...`..c.................r.........../............@.................................1].........................................(.... ...u..........................................................`...@...............L............................text...`q.......r.................. ..`.rdata..\%.......&...v..............@..@.data....W.......v..................@....rsrc....u... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.248033329266071
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lYWiDKe1In.exe
File size:	296'960 bytes
MD5:	985584f5b7be5d605c1264624f4bd68e
SHA1:	8efbf3680021b3fb3b68094ee5296dcabb5abc1a
SHA256:	5496d968b378eef69af5eb89159bc728b8ad9e395e42c74f788a4b7a8ec8a7bd
SHA512:	e6c582d168f066c031161b8b098114edd95f5fde5c70eb1e8150fb44fd3520a4be7e9e71195c3c58078d7b9802e053ffa3e452a87965eb9e6a0ac580ccd8e34b
SSDEEP:	3072:NNnq5gpiR+cS7kBapQOm47e6rGyQqKCHRsJFULJtkSUyHbmcnTVaz42JVOrTKYj:rq5gN70xee6treFD7y7mcnTVaBJVOrT
TLSH:	ED54391392DCBC40EC2387399F1E96EC7F1EB8529E19671622086E1FE471AB1F593718
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..p...#...#...#u.\|#...#u.I#...#u.}#R..#..D#...#...#C..#u.x#...#u.M#...#u.J#...#Rich...#........PE..L...`..c.................r.

File Icon


Icon Hash:	53294d456555510d

Static PE Info

General

Entrypoint:	0x402f14
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63EEF760 [Fri Feb 17 03:41:20 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	21bb6d66b5d6d28ae8c3bacf2985bb75

Entrypoint Preview

Instruction
call 00007FB6F0D0F17Ah
jmp 00007FB6F0D0CD5Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [0040C008h+ecx*8]
je 00007FB6F0D0CEE5h
inc ecx
cmp ecx, 2Dh
jc 00007FB6F0D0CEC3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007FB6F0D0CEE0h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0040C00Ch+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007FB6F0D0E2C6h
test eax, eax
jne 00007FB6F0D0CED8h
mov eax, 0040C170h
ret
add eax, 08h
ret
call 00007FB6F0D0E2B3h
test eax, eax
jne 00007FB6F0D0CED8h
mov eax, 0040C174h
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007FB6F0D0CEB7h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007FB6F0D0CE57h
pop ecx
mov esi, eax
call 00007FB6F0D0CE91h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
push 00000000h
push 00001000h
push 00000000h
call dword ptr [00409088h]
xor ecx, ecx
test eax, eax
setne cl
mov dword ptr [00423530h], eax
mov eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, 00001AE4h
call 00007FB6F0D0F62Fh
mov eax, dword ptr [0040C570h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xadd4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x27598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xadfc	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xaa60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7160	0x7200	3de7dc72e13d0ee770d19a01f0691356	False	0.6467927631578947	data	6.656480119984569	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x255c	0x2600	ccb0be395dd31b91bb77980b7c869ffb	False	0.34405838815789475	data	4.720629897356499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x257ac	0x17600	197638676936b42882dd165ea9cfd941	False	0.8875752005347594	data	7.585266498834436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x32000	0x27598	0x27600	a83116d9e8f4d8f08b8fba5dbd3867ca	False	0.3700768849206349	data	4.786838083849537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x51f50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x52df8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x536a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x53c38	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x53d68	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x53e40	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x54ce8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x55590	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x55b28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x569d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x57278	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x32cd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Japanese	Japan	0.47574626865671643
RT_ICON	0x33b78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Japanese	Japan	0.5911552346570397
RT_ICON	0x34420	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Japanese	Japan	0.652073732718894
RT_ICON	0x34ae8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Japanese	Japan	0.6828034682080925
RT_ICON	0x35050	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Japanese	Japan	0.3746887966804979
RT_ICON	0x375f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Japanese	Japan	0.4772514071294559
RT_ICON	0x386a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Japanese	Japan	0.5545081967213115
RT_ICON	0x39028	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Japanese	Japan	0.6320921985815603
RT_ICON	0x39508	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.4182027649769585
RT_ICON	0x39bd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.16400414937759336
RT_ICON	0x3c178	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.21365248226950354
RT_ICON	0x3c610	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.4182027649769585
RT_ICON	0x3ccd8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.16400414937759336
RT_ICON	0x3f280	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.21365248226950354
RT_ICON	0x3f718	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.3675373134328358
RT_ICON	0x405c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.453971119133574
RT_ICON	0x40e68	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.4596774193548387
RT_ICON	0x41530	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.4486994219653179
RT_ICON	0x41a98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.26680497925311203
RT_ICON	0x44040	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.3074577861163227
RT_ICON	0x450e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.3608156028368794
RT_ICON	0x455b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.5652985074626866
RT_ICON	0x46460	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.549187725631769
RT_ICON	0x46d08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.6192196531791907
RT_ICON	0x47270	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.46255186721991703
RT_ICON	0x49818	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.48827392120075047
RT_ICON	0x4a8c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Japanese	Japan	0.49098360655737705
RT_ICON	0x4b248	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.4521276595744681
RT_ICON	0x4b718	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.4163113006396588
RT_ICON	0x4c5c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.5112815884476535
RT_ICON	0x4ce68	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.6036866359447005
RT_ICON	0x4d530	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.5447976878612717
RT_ICON	0x4da98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.4386929460580913
RT_ICON	0x50040	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.4580206378986867
RT_ICON	0x510e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Japanese	Japan	0.4680327868852459
RT_ICON	0x51a70	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.5150709219858156
RT_STRING	0x57a80	0x3f2	data	Japanese	Japan	0.46633663366336636
RT_STRING	0x57e78	0x64e	data	Japanese	Japan	0.4306071871127633
RT_STRING	0x584c8	0x28e	data	Japanese	Japan	0.4908256880733945
RT_STRING	0x58758	0x18e	data	Japanese	Japan	0.5100502512562815
RT_STRING	0x588e8	0x2d2	data	Japanese	Japan	0.4626038781163435
RT_STRING	0x58bc0	0x6fa	data	Japanese	Japan	0.4227323628219485
RT_STRING	0x592c0	0x2d2	data	Japanese	Japan	0.4695290858725762
RT_GROUP_CURSOR	0x53c08	0x30	data			0.9375
RT_GROUP_CURSOR	0x53e18	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x55af8	0x30	data			0.9375
RT_GROUP_CURSOR	0x577e0	0x30	data			0.9375
RT_GROUP_ICON	0x4b6b0	0x68	data	Japanese	Japan	0.7211538461538461
RT_GROUP_ICON	0x3c5e0	0x30	data	Japanese	Japan	1.0
RT_GROUP_ICON	0x39490	0x76	data	Japanese	Japan	0.6610169491525424
RT_GROUP_ICON	0x45550	0x68	data	Japanese	Japan	0.7115384615384616
RT_GROUP_ICON	0x3f6e8	0x30	data	Japanese	Japan	1.0
RT_GROUP_ICON	0x51ed8	0x76	data	Japanese	Japan	0.6779661016949152
RT_VERSION	0x57810	0x270	data			0.5080128205128205

Imports

DLL

Import

KERNEL32.dll

PeekNamedPipe, TlsGetValue, LoadLibraryExW, InterlockedCompareExchange, SetComputerNameW, GetTickCount, GetUserDefaultLangID, GlobalAlloc, LoadLibraryW, lstrcatA, GetACP, IsBadStringPtrA, GetLastError, SetLastError, GetProcAddress, SetComputerNameA, GetDiskFreeSpaceW, LoadLibraryA, SetConsoleCtrlHandler, FoldStringW, GetModuleFileNameA, FindFirstVolumeMountPointA, BuildCommDCBA, OutputDebugStringA, TerminateJobObject, GetWindowsDirectoryW, WriteProcessMemory, HeapFree, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, HeapCreate, WriteFile, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, Sleep, HeapSize, GetModuleHandleW, ExitProcess, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapAlloc, SetUnhandledExceptionFilter, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, UnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, WriteConsoleW, MultiByteToWideChar, SetFilePointer, SetStdHandle, RtlUnwind, GetCPInfo, GetOEMCP, IsValidCodePage, CreateFileW, CloseHandle, GetStringTypeW, LCMapStringW, IsProcessorFeaturePresent

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 14, 2024 11:19:57.300287008 CEST	49706	25	192.168.2.5	52.101.40.26
Jun 14, 2024 11:19:58.301883936 CEST	49706	25	192.168.2.5	52.101.40.26
Jun 14, 2024 11:20:00.232022047 CEST	49707	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:00.232121944 CEST	443	49707	62.76.228.127	192.168.2.5
Jun 14, 2024 11:20:00.232233047 CEST	49707	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:00.301918030 CEST	49706	25	192.168.2.5	52.101.40.26
Jun 14, 2024 11:20:04.302027941 CEST	49706	25	192.168.2.5	52.101.40.26
Jun 14, 2024 11:20:12.301871061 CEST	49706	25	192.168.2.5	52.101.40.26
Jun 14, 2024 11:20:17.319574118 CEST	49714	25	192.168.2.5	98.136.96.91
Jun 14, 2024 11:20:18.333168983 CEST	49714	25	192.168.2.5	98.136.96.91
Jun 14, 2024 11:20:20.333355904 CEST	49714	25	192.168.2.5	98.136.96.91
Jun 14, 2024 11:20:24.348865032 CEST	49714	25	192.168.2.5	98.136.96.91
Jun 14, 2024 11:20:32.364329100 CEST	49714	25	192.168.2.5	98.136.96.91
Jun 14, 2024 11:20:37.337373972 CEST	64298	25	192.168.2.5	64.233.184.26
Jun 14, 2024 11:20:38.348701000 CEST	64298	25	192.168.2.5	64.233.184.26
Jun 14, 2024 11:20:40.223820925 CEST	49707	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:40.224026918 CEST	443	49707	62.76.228.127	192.168.2.5
Jun 14, 2024 11:20:40.224092960 CEST	49707	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:40.344501019 CEST	64299	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:40.344532013 CEST	443	64299	62.76.228.127	192.168.2.5
Jun 14, 2024 11:20:40.344619036 CEST	64299	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:20:40.348694086 CEST	64298	25	192.168.2.5	64.233.184.26
Jun 14, 2024 11:20:44.348665953 CEST	64298	25	192.168.2.5	64.233.184.26
Jun 14, 2024 11:20:52.348782063 CEST	64298	25	192.168.2.5	64.233.184.26
Jun 14, 2024 11:20:57.367269993 CEST	64300	25	192.168.2.5	217.69.139.150
Jun 14, 2024 11:20:58.379986048 CEST	64300	25	192.168.2.5	217.69.139.150
Jun 14, 2024 11:21:00.379911900 CEST	64300	25	192.168.2.5	217.69.139.150
Jun 14, 2024 11:21:04.380215883 CEST	64300	25	192.168.2.5	217.69.139.150
Jun 14, 2024 11:21:12.395672083 CEST	64300	25	192.168.2.5	217.69.139.150
Jun 14, 2024 11:21:20.333808899 CEST	64299	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:21:20.333946943 CEST	443	64299	62.76.228.127	192.168.2.5
Jun 14, 2024 11:21:20.334145069 CEST	64299	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:21:20.443283081 CEST	64301	443	192.168.2.5	62.76.228.127
Jun 14, 2024 11:21:20.443377018 CEST	443	64301	62.76.228.127	192.168.2.5
Jun 14, 2024 11:21:20.443484068 CEST	64301	443	192.168.2.5	62.76.228.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 14, 2024 11:19:57.038203001 CEST	50046	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:19:57.299690962 CEST	53	50046	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:00.025577068 CEST	55414	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:00.229147911 CEST	53	55414	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:17.302576065 CEST	61262	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:17.310014009 CEST	53	61262	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:17.310559988 CEST	52137	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:17.318939924 CEST	53	52137	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:26.075371027 CEST	53	51589	162.159.36.2	192.168.2.5
Jun 14, 2024 11:20:26.683720112 CEST	56341	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:26.712798119 CEST	53	56341	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:37.318026066 CEST	54010	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:37.328125954 CEST	53	54010	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:37.329055071 CEST	49158	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:37.336936951 CEST	53	49158	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:40.333730936 CEST	61793	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:40.342572927 CEST	53	61793	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:57.349203110 CEST	57705	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:57.357225895 CEST	53	57705	1.1.1.1	192.168.2.5
Jun 14, 2024 11:20:57.357790947 CEST	60116	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:20:57.366835117 CEST	53	60116	1.1.1.1	192.168.2.5
Jun 14, 2024 11:21:56.953308105 CEST	61726	53	192.168.2.5	1.1.1.1
Jun 14, 2024 11:21:56.983558893 CEST	53	61726	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 14, 2024 11:19:57.038203001 CEST	192.168.2.5	1.1.1.1	0xebee	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:00.025577068 CEST	192.168.2.5	1.1.1.1	0x146c	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.302576065 CEST	192.168.2.5	1.1.1.1	0x98a0	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:17.310559988 CEST	192.168.2.5	1.1.1.1	0x8547	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:26.683720112 CEST	192.168.2.5	1.1.1.1	0xe221	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jun 14, 2024 11:20:37.318026066 CEST	192.168.2.5	1.1.1.1	0xeb6f	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:37.329055071 CEST	192.168.2.5	1.1.1.1	0xb687	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:40.333730936 CEST	192.168.2.5	1.1.1.1	0x70e8	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:57.349203110 CEST	192.168.2.5	1.1.1.1	0xa2f0	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:57.357790947 CEST	192.168.2.5	1.1.1.1	0xc492	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:21:56.953308105 CEST	192.168.2.5	1.1.1.1	0x94b3	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 14, 2024 11:19:57.299690962 CEST	1.1.1.1	192.168.2.5	0xebee	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:19:57.299690962 CEST	1.1.1.1	192.168.2.5	0xebee	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:19:57.299690962 CEST	1.1.1.1	192.168.2.5	0xebee	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:19:57.299690962 CEST	1.1.1.1	192.168.2.5	0xebee	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:00.229147911 CEST	1.1.1.1	192.168.2.5	0x146c	No error (0)	vanaheim.cn		62.76.228.127	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.310014009 CEST	1.1.1.1	192.168.2.5	0x98a0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:17.310014009 CEST	1.1.1.1	192.168.2.5	0x98a0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:17.310014009 CEST	1.1.1.1	192.168.2.5	0x98a0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:17.318939924 CEST	1.1.1.1	192.168.2.5	0x8547	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:26.712798119 CEST	1.1.1.1	192.168.2.5	0xe221	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jun 14, 2024 11:20:37.328125954 CEST	1.1.1.1	192.168.2.5	0xeb6f	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:37.336936951 CEST	1.1.1.1	192.168.2.5	0xb687	No error (0)	smtp.google.com		64.233.184.26	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:37.336936951 CEST	1.1.1.1	192.168.2.5	0xb687	No error (0)	smtp.google.com		74.125.206.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:37.336936951 CEST	1.1.1.1	192.168.2.5	0xb687	No error (0)	smtp.google.com		64.233.184.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:37.336936951 CEST	1.1.1.1	192.168.2.5	0xb687	No error (0)	smtp.google.com		74.125.206.26	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:37.336936951 CEST	1.1.1.1	192.168.2.5	0xb687	No error (0)	smtp.google.com		142.251.173.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:40.342572927 CEST	1.1.1.1	192.168.2.5	0x70e8	No error (0)	vanaheim.cn		62.76.228.127	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:57.357225895 CEST	1.1.1.1	192.168.2.5	0xa2f0	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 11:20:57.366835117 CEST	1.1.1.1	192.168.2.5	0xc492	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:20:57.366835117 CEST	1.1.1.1	192.168.2.5	0xc492	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:21:56.983558893 CEST	1.1.1.1	192.168.2.5	0x94b3	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
Jun 14, 2024 11:21:56.983558893 CEST	1.1.1.1	192.168.2.5	0x94b3	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:19:49
Start date:	14/06/2024
Path:	C:\Users\user\Desktop\lYWiDKe1In.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lYWiDKe1In.exe"
Imagebase:	0x400000
File size:	296'960 bytes
MD5 hash:	985584F5B7BE5D605C1264624F4BD68E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1993040639.0000000000900000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:19:50
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\djiglggs\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:19:50
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:19:51
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe" C:\Windows\SysWOW64\djiglggs\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:19:51
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:19:52
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create djiglggs binPath= "C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d\"C:\Users\user\Desktop\lYWiDKe1In.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:19:52
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:19:52
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description djiglggs "wifi internet conection"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:19:52
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:19:53
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start djiglggs
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:19:53
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:19:53
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe /d"C:\Users\user\Desktop\lYWiDKe1In.exe"
Imagebase:	0x400000
File size:	11'102'720 bytes
MD5 hash:	DEA876A83A60426A2C1F32D0E6A77799
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2035375237.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2039462010.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:19:53
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:19:53
Start date:	14/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:19:54
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:19:54
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3572 -ip 3572
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:19:54
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x860000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:19:54
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1772 -ip 1772
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:19:54
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1028
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:19:55
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 536
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:20:37
Start date:	14/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	25.4%
Total number of Nodes:	1558
Total number of Limit Nodes:	26

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
D, xrefs: 00409F8E
\, xrefs: 00409D0C
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA
", xrefs: 00409EDB

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00717BDE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00717C06
Module32First.KERNEL32(00000000,00000224), ref: 00717C26

Memory Dump Source

Source File: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, Offset: 00713000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_713000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4d52fa66009f214dbfafc3ed93a54bab843ce052d0ddeb1c2b9d44df44830ec4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E8F06235104715ABD7242EB9988DAAAB6FCAF49725F100568E642D10C0DB78EC85CAA1

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 15625d6cb101808bdea6f9395adb21b3a8eafb42943f0309c545178590061202
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: 15625d6cb101808bdea6f9395adb21b3a8eafb42943f0309c545178590061202
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 006E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006E024D

Strings

kernel32.dll, xrefs: 006E008F, 006E0095
cess, xrefs: 006E018D

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0e35a6c12bade70b1b465d455dd422e68b4f7a7e37c090aa8174b37a3a36a116
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 12527874A01269DFDB64CF59C984BA8BBB1BF09304F1480D9E90DAB351DB70AE85DF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 006E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006E0223,?,?), ref: 006E0E19
SetErrorMode.KERNELBASE(00000000,?,?,006E0223,?,?), ref: 006E0E1E

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5910df1618b4d58ae791dba76823746767ea92d9917d6bbb5d2ec6216bae3b2e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4AD0123114522877D7002A95DC09BCD7B1CDF05B62F008421FB0DD9180C7B0994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 0071789D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007178EE

Memory Dump Source

Source File: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, Offset: 00713000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_713000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 721d02ed8c44b5520554b63be172a62b7abfeb8004f60ff90cef98a8cb4d3ff9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A8113F79A00208EFDB01DF98C985E98BBF5EF08351F158094F9489B362D375EA90DF90

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
wtm_r, xrefs: 0040C97F
srv_time, xrefs: 0040CABB
4, xrefs: 0040D9F7
lid_file_upd, xrefs: 0040CE6A
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
flags_upd, xrefs: 0040CE4A
drivers\, xrefs: 0040D067
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
wtm_c, xrefs: 0040C956
wtm_w, xrefs: 0040C96C
.sys, xrefs: 0040D0CC
\, xrefs: 0040D3A7
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
local_time, xrefs: 0040CACD
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D39D
@, xrefs: 0040D754

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135
RtlFreeSid, xrefs: 00401116
NtSetInformationToken, xrefs: 00401175
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtFilterToken, xrefs: 0040122B
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
NtDuplicateToken, xrefs: 004011F3
RtlSetLastWin32Error, xrefs: 004010D6
RtlLengthSid, xrefs: 00401246
NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationThread, xrefs: 00401155

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Feb, xrefs: 0040B25D
Tue, xrefs: 0040B233
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Jun, xrefs: 0040B279
May, xrefs: 0040B272
Sat, xrefs: 0040B24F
Apr, xrefs: 0040B26B
Mon, xrefs: 0040B22C
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Thu, xrefs: 0040B241
Wed, xrefs: 0040B23A
Mar, xrefs: 0040B264
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Jul, xrefs: 0040B280

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
<, xrefs: 00401378
@, xrefs: 00401380
, xrefs: 00401462
uac, xrefs: 00401628
%systemroot%\system32\cmd.exe, xrefs: 00401316
PDGu, xrefs: 0040139A
D, xrefs: 004015C6

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
lid_file_upd, xrefs: 00401E25
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 006E65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006E65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006E6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 006E6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006E6652

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 9c946228880120cfc26f461bf6be6b8ca6857194d986ab6834b25876a5756b0c
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 86119171611358BFDB219F66DC0AF9B3FA9EB047A5F104024F908A7291D7B1DD0086A4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 006E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006E09DC, 006E09DF, 006E09E4
l, xrefs: 006E0966
., xrefs: 006E095F

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 00360f923b02206ba4e0abf178a40f94604574d281b8d41a332c48d6b120a506
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 343139B6901749DFEB10CF99C884AADBBF6FF48324F14504AD441A7312D7B1EA85CBA4

Function 007174BB Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Mtq, xrefs: 007174C1

Memory Dump Source

Source File: 00000000.00000002.2039090493.0000000000713000.00000040.00000020.00020000.00000000.sdmp, Offset: 00713000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_713000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID:
String ID: Mtq
API String ID: 0-3948034777
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: cbe5fe23906aeb980df5cbdd8d2c942ea7892c8f7dcbf282c109050f0786c6b3
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 0B117072344100AFD754DE59DC81FE673EAEB89360B298055ED04CB396D679EC51C760

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 006E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 4abe33874204280607049c3fe1d50a54ae18a97c1e974f731f868581595d7917
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AB0184766027448FEB21CF65CC04BEA33A6EF85315F4544B5D506D7245E7B4A9818F90

Function 006E9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006E9E6D
lstrcpy.KERNEL32(?,00000000), ref: 006E9FE1
lstrcat.KERNEL32(?,?), ref: 006E9FF2
lstrcat.KERNEL32(?,0041070C), ref: 006EA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 006EA054
DeleteFileA.KERNEL32(?), ref: 006EA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 006EA0D6
lstrcpy.KERNEL32 ref: 006EA12F
lstrlen.KERNEL32(00000022), ref: 006EA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 006E9F13

Part of subcall function 006E7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 006E7081

Part of subcall function 006E6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\xdcafaam,006E7043), ref: 006E6F4E
Part of subcall function 006E6F30: GetProcAddress.KERNEL32(00000000), ref: 006E6F55
Part of subcall function 006E6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006E6F7B
Part of subcall function 006E6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006E6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 006EA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006EA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 006EA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 006EA21B
GetDriveTypeA.KERNEL32(?), ref: 006EA265
lstrcat.KERNEL32(?,00000000), ref: 006EA29F
lstrcat.KERNEL32(?,00410A34), ref: 006EA2C5
lstrcat.KERNEL32(?,00000022), ref: 006EA2D9
lstrcat.KERNEL32(?,00410A34), ref: 006EA2F4
wsprintfA.USER32 ref: 006EA31D
lstrcat.KERNEL32(?,00000000), ref: 006EA345
lstrcat.KERNEL32(?,?), ref: 006EA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 006EA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 006EA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006EA1D1

Part of subcall function 006E9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006E999D
Part of subcall function 006E9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006E99BD
Part of subcall function 006E9966: RegCloseKey.ADVAPI32(?), ref: 006E99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 006EA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 006EA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 006EA41D

Strings

", xrefs: 006EA2DF
P, xrefs: 006EA011
D, xrefs: 006EA1F5
\, xrefs: 006E9F73
", xrefs: 006EA3F0
", xrefs: 006EA142

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: ec989bdf308fcbbf570445a3e97b7d5386daad27de9396d6f05636883919171c
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: F7F161B1D41399AFDF11DBA18C49EEF7BBDAF08304F0440AAF605E2142E7759A848F65

Function 006E7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 006E7D21
GetUserNameA.ADVAPI32(?,?), ref: 006E7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006E7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 006E7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006E7DC0
EqualSid.ADVAPI32(?,?), ref: 006E7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 006E7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006E7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006E7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 006E7E12
LocalFree.KERNEL32(00000000), ref: 006E7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006E7E35

Strings

PromptOnSecureDesktop, xrefs: 006E7FA0
D, xrefs: 006E7D73

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 98d9475f0805ae9ccb6746b0299c7d252e773d1dd03c7c51d92381fdb721e58c
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 2EA14E71901259AFDF11CFA1DD88FEEBFBAFB08300F148469E505E6250EB758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
12:08:32, xrefs: 00406535
localcfg, xrefs: 0040672D
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

localcfg, xrefs: 0040AB0B
., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
data, xrefs: 0040A85E
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
mail from:<%s>, xrefs: 0040A848
Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1
AUTH LOGIN, xrefs: 0040A80C
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 006E7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006E7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006E7ACD
GetLengthSid.ADVAPI32(?), ref: 006E7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 006E7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006E7B1F
EqualSid.ADVAPI32(?,?), ref: 006E7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 006E7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006E7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006E7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 006E7B77
LocalFree.KERNEL32(00000000), ref: 006E7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006E7B9A
GetAce.ADVAPI32(?,?,?), ref: 006E7BCA
EqualSid.ADVAPI32(?,?), ref: 006E7BF1
DeleteAce.ADVAPI32(?,?), ref: 006E7C0A
EqualSid.ADVAPI32(?,?), ref: 006E7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 006E7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006E7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 006E7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 006E7CE0
LocalFree.KERNEL32(00000000), ref: 006E7CEE

Strings

D, xrefs: 006E7AC3

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f2672d8ebc7670fe1fca00435faed2c31c37168a26eebc5ffcde939c34951506
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 58817C7190524AAFDB21CFA1DD84FEEBBBDFF08704F24806AE505E6250D7358A41CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 006E858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 006E865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 006E867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006E86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006E86B1

Strings

PromptOnSecureDesktop, xrefs: 006E85B6, 006E8645, 006E86BD, 006E8708, 006E87C5, 006E8812, 006E88E9, 006E8905
", xrefs: 006E896C

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 763583c0531e8b4b98b2e24b5f8ae6afc2a3adb2584622b5c02b68c4dcfc1314
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 83C1C2B1902389BEEB11ABA5DD85EEF7BBEEB04300F144069F508E7151EB714A848B65

Function 006E14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006E1601
lstrlenW.KERNEL32(-00000003), ref: 006E17D8

Strings

@, xrefs: 006E15E7
<, xrefs: 006E15DF
D, xrefs: 006E182D
, xrefs: 006E16C9

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: e4273ee04de08f321fd11cc54a853739566c0c39174341244ecf5730f16185af
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 28F1BDB11093819FD720CF65C888BABB7E6FB8A700F00892DF5969B390D7B4D944DB56

Function 006E7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006E76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 006E7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 006E778F
___ascii_stricmp.LIBCMT ref: 006E78B4
RegCloseKey.ADVAPI32(?), ref: 006E794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006E796D
RegCloseKey.ADVAPI32(?), ref: 006E797E
RegCloseKey.ADVAPI32(?), ref: 006E79AC
RegCloseKey.ADVAPI32(?), ref: 006E7A56

Part of subcall function 006EF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,006E772A,?), ref: 006EF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006E79F6
RegCloseKey.ADVAPI32(?), ref: 006E7A4D

Strings

PromptOnSecureDesktop, xrefs: 006E76C5, 006E76CA, 006E76E5, 006E7782, 006E77E6, 006E7862, 006E787B, 006E79C2
", xrefs: 006E7800

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 65e7d35e84a68d59f56e3d6b82484250ee158211c81a024e04dcec1447754d7a
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 70C1C472905389AFEB11DBA6DC45FEE7BBAEF45310F1000A5F504E6191EB71DE808B64

Function 006E2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006E2CED
socket.WS2_32(00000002,00000002,00000011), ref: 006E2D07
htons.WS2_32(00000000), ref: 006E2D42
select.WS2_32 ref: 006E2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 006E2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006E2E62

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 59c10e3a67090f57e90e486e3f7e7827f746cf4068370260393112e0ebc5ecf1
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: E761F271505396ABC3209F62DC09BABBBFEFF88341F144819F98497251D7B4D8818BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 006E958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006E95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006E95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 006E95DC
wsprintfA.USER32 ref: 006E9635
wsprintfA.USER32 ref: 006E9673
wsprintfA.USER32 ref: 006E96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 006E9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006E978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006E97D8

Strings

PromptOnSecureDesktop, xrefs: 006E9604, 006E9624, 006E9662, 006E9683, 006E96B6, 006E96DF, 006E9701, 006E9734, 006E9780, 006E97B7

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 84dbe16e0c46d0ee00c72ac732030e4d5bddab5e9cb044500156b12ff1fd7f1c
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 9CA17FB190138CABEF21DFA2CC45FDA3BAEEF05740F10402AF91596152E775D9848BA5

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 006E1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 006E202D
GetSystemInfo.KERNEL32(?), ref: 006E204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 006E206A
GetProcAddress.KERNEL32(00000000), ref: 006E2071
GetCurrentProcess.KERNEL32(?), ref: 006E2082
GetTickCount.KERNEL32 ref: 006E2230

Part of subcall function 006E1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 006E1E7C

Strings

localcfg, xrefs: 006E2091, 006E2098, 006E20AB, 006E20E4, 006E20F3, 006E2119, 006E2138, 006E214E, 006E2166, 006E2183, 006E219B, 006E21B7, 006E21D7
hi_id, xrefs: 006E217D, 006E2182, 006E219A
flags_upd, xrefs: 006E20A5, 006E20AA, 006E20E3
work_srv, xrefs: 006E20C5

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: aa3c90664f783601e5eaff5e2649694df147b659b862f0fcc71a4666218de20d
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 2C514EB15013C46FE370AF768C86FA77AEDEF44704F00092DFA9682242D7B59984C769

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 006E3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 006E3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 006E3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 006E3095
RtlAllocateHeap.NTDLL(00000000), ref: 006E30B6
htons.WS2_32(00000035), ref: 006E30EF
inet_addr.WS2_32(?), ref: 006E30FA
gethostbyname.WS2_32(?), ref: 006E310D
HeapFree.KERNEL32(00000000), ref: 006E314D

Strings

iphlpapi.dll, xrefs: 006E3062, 006E3067, 006E3077

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: dd02d115eb986b447db568841f8ae4ea3cc28542cddb16bc959b6863897b3e38
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: C331D631A01396BBDB119BBA9C4CAEE77B9EF04360F148129F518E3390DB74DE418B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 006E6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006E67C3
htonl.WS2_32(?), ref: 006E67DF
htonl.WS2_32(?), ref: 006E67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006E68F1
ExitProcess.KERNEL32 ref: 006E69BC

Strings

localcfg, xrefs: 006E6994
except_info, xrefs: 006E698F

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 96d386105e937650082867a9e844b2d9706c23e1c6e0cdaec118c5ab09bbdc58
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 6A616F71940348AFDB609FB4DC45FEA77E9FB08300F24806AF96DD2161EA7599908F54

Function 006EF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(006ECC84), ref: 006EF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 006EF5CE
closesocket.WS2_32(00000000), ref: 006EF5DC

Strings

time_cfg, xrefs: 006EF58A

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 6ac1b7f1908eb07e496631bdc137d5c68fadac1c5b3c3ac7db9e635618895afa
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: D4318C72901258ABDB10DFA6DC89DEF7BBDEF89310F10457AF905E3150E7708A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 006E2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 006E2FA1
LoadLibraryA.KERNEL32(?), ref: 006E2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 006E2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006E3000
RtlAllocateHeap.NTDLL(00000000), ref: 006E3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 006E3032

Strings

dnsapi.dll, xrefs: 006E2F90

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: e485de5fb5896a419eab30a7b8bcf37f21a8a708fcc80dba669f705aa68e4c51
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 1B21A471942366BBCB219B56DC489EEBBBEEF08B10F104421F901E7240D7B49E8187D4

Function 006E6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\xdcafaam,006E7043), ref: 006E6F4E
GetProcAddress.KERNEL32(00000000), ref: 006E6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006E6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006E6F92

Strings

PromptOnSecureDesktop, xrefs: 006E6F9D, 006E6FBF, 006E6FCF, 006E6FE5, 006E6FF5
C:\Windows\SysWOW64\, xrefs: 006E6F30, 006E6F38, 006E6F65, 006E6F6C, 006E6F7A, 006E6F85, 006E6F91, 006E6FA9, 006E6FC6, 006E6FEC
\\.\pipe\xdcafaam, xrefs: 006E6F37

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\xdcafaam
API String ID: 1082366364-2732631617
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: f271817cf85ab9bbd91f4cc3e5447ea0bb9447f0653c2434b092aada9c237fc3
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 5C213B617463C07AF7225733AC89FF73E4F8B62750F1840A9F404D62D1DAD988D5826D

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 006E92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006E92E2
wsprintfA.USER32 ref: 006E9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006E9375
lstrlen.KERNEL32(?,?,00000000), ref: 006E9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 006E9394
CloseHandle.KERNEL32(00000000), ref: 006E939B

Strings

PromptOnSecureDesktop, xrefs: 006E932B, 006E9343, 006E935E

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 513f6f6276884c5e1f0c404ed35577fd332fcdbfc705c736254cc3dbbff01eaa
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 24119AB17412547BE7606732DC0EFEF3A6EDFC4B10F00C069BB09E5091EEB54A418668

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 006E99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 006E9A18
GetThreadContext.KERNEL32(?,?), ref: 006E9A52
TerminateProcess.KERNEL32(?,00000000), ref: 006E9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 006E9A98
SetThreadContext.KERNEL32(?,00010002), ref: 006E9AB5
ResumeThread.KERNEL32(?), ref: 006E9AC2

Strings

D, xrefs: 006E9A10

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 00d10d9dd3cf6aaa85b3239dfd9db4581f9c6e5b5073a3e6ce686ed0673c445c
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: CE213BB1A02219BBDB119BA6DC09EEF7BBDEF04750F404061BA19E6150EB758A44CBA4

Function 006E1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 006E1C18
LoadLibraryA.KERNEL32(004102C8), ref: 006E1C26
GetProcessHeap.KERNEL32 ref: 006E1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 006E1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 006E1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 006E1D02
FreeLibrary.KERNEL32(?), ref: 006E1D0B

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: b12b1b3e8d966e51d78f8f3a7fe65995ddb358e8adebbeb33f7157c2034f37ed
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 27313E31E01259BFCB119FA5DC888EEBABAEF46711B24447AE501E7210D7B54E80EB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 006E6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 006E6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 006E6D22
GetLastError.KERNEL32 ref: 006E6DA7
CloseHandle.KERNEL32(?), ref: 006E6DB5
GetLastError.KERNEL32 ref: 006E6DD6
DeleteFileA.KERNEL32(?), ref: 006E6DE7
GetLastError.KERNEL32 ref: 006E6DFD

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 85683c3e808fad4b7ccbb8914c951943efdea4a7793caa1b3156173478acfe02
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 5A312372A02389BFCB01DFA5DD48ADEBF7AEF58340F148065F211E3261D7708A418B65

Function 006EE2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,006EE50A,00000000,00000000,00000000,00020106,00000000,006EE50A,00000000,000000E4), ref: 006EE319
RegSetValueExA.ADVAPI32(006EE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006EE38E
RegDeleteValueA.ADVAPI32(006EE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dn), ref: 006EE3BF
RegCloseKey.ADVAPI32(006EE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dn,006EE50A), ref: 006EE3C8

Strings

PromptOnSecureDesktop, xrefs: 006EE33A
Dn, xrefs: 006EE2FC

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop$Dn
API String ID: 2667537340-2952939467
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 567a8b2987eb3296431d5b9109ca6415370ed496ec3dfec6b0b9d6545c83943b
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: D2215E71A0125DBBDF209FA5EC89EDE7F7AEF08750F008065F904E6151E2728A54DBA0

Function 006E93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006E93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 006E93CD
CharToOemA.USER32(?,?), ref: 006E93DB
wsprintfA.USER32 ref: 006E9410

Part of subcall function 006E92CB: GetTempPathA.KERNEL32(00000400,?), ref: 006E92E2
Part of subcall function 006E92CB: wsprintfA.USER32 ref: 006E9350
Part of subcall function 006E92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006E9375
Part of subcall function 006E92CB: lstrlen.KERNEL32(?,?,00000000), ref: 006E9389
Part of subcall function 006E92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 006E9394
Part of subcall function 006E92CB: CloseHandle.KERNEL32(00000000), ref: 006E939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 006E9448

Strings

PromptOnSecureDesktop, xrefs: 006E93FA, 006E93FF, 006E941C

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 308c0d05a818fdad1731cb7ed95ef9a3cc1bc2685eff2045f2ffb5dad82e478e
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 1A0192F69002587BDB20A7619D49EDF3B7CDB85701F0000A5BB09E2080DAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 006EAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 006EAAE5

Strings

localcfg, xrefs: 006EAD72
, xrefs: 006EABB3

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: d60557c727d6ab582ed2e570b4d2a722c7184c8f03001642f48a10603414e06c
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 4C714D71A023C8ABDF218BD6DC85FEE376B9F00714F34406AF905A6191DA61BDC4875B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 006EE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EDF6C: GetCurrentThreadId.KERNEL32 ref: 006EDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 006EE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,006E6128), ref: 006EE950
lstrcmp.KERNEL32(?,00000008), ref: 006EE989

Strings

A, xrefs: 006EE8C6, 006EE8CD, 006EE936, 006EE998
A, xrefs: 006EE960, 006EE965
A, xrefs: 006EE9A0

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 8e1fee7c1a872965d0454d35fcf49451b94f0c7c68f3a9a398cf1ef2f19f465b
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 7B31CF31602785DFCF71CF26C884BE67BE6EB15720F10892AE55687652E372EC80CB85

Function 006E6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 006E6E19

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: b5461718b341e8b26fa955c4567864dec0a7e2870d7f5e7d9098f34a90719dfb
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 6D218E7610A355BFDB109B72FC49EDF3FAEDB483A0B208465F502D1091EB719A009678

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 006EC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006EC6B4
InterlockedIncrement.KERNEL32(006EC74B), ref: 006EC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,006EC747), ref: 006EC728
CloseHandle.KERNEL32(00000000,?,006EC747,00413588,006E8A77), ref: 006EC733

Strings

localcfg, xrefs: 006EC544

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: c52be29b7f79b3ed000d51a58abe81a842cad18743b8440623c85279e3e55273
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: E4514DB1A02B818FD7648F6AC5C552BBBEAFB48310B50593EE18BC7B90D774F8418B14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 006E71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006E71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006E7228
LocalFree.KERNEL32(?,?,?), ref: 006E7286
wsprintfA.USER32 ref: 006E729D

Strings

|, xrefs: 006E721A

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 48085b1cf23f7f7bc66d9fb16c8bbc81befcffd9b99cb1fe284052c8d2a92e65
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 41316972A04248BFDB01DFA9DC45ADA3BADEF04310F14C066F909DB201EA75DB488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 006EB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006EB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006EB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 006EB548
GetTimeZoneInformation.KERNEL32(?), ref: 006EB590
wsprintfA.USER32 ref: 006EB61E

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 33d2410a7dbedb11b6cf6c3c52f739016d6ce386846e305fe555283ba7583f21
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 57511FB1D0125CAACF14DFD5D8895EEBBBABF48304F10816AF505A6150E7B84AC9CF98

Function 006E62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 006E6303
LoadLibraryA.KERNEL32(?), ref: 006E632A
GetProcAddress.KERNEL32(00000000,?), ref: 006E63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 006E6405

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 13a4f0acc18cf1ee765016eb79ce1498e482502868fd118256685dbae9d7b069
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: B1417B71A01349EFDB14CF5AC884AA9B7BAEF24394F248169F815D7390E731ED45CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 006EE3DE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Dn,00000000,00000000,00000000), ref: 006EE470
CloseHandle.KERNEL32(00000001,00000003), ref: 006EE484

Part of subcall function 006EE2FC: RegCreateKeyExA.ADVAPI32(80000001,006EE50A,00000000,00000000,00000000,00020106,00000000,006EE50A,00000000,000000E4), ref: 006EE319
Part of subcall function 006EE2FC: RegSetValueExA.ADVAPI32(006EE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006EE38E
Part of subcall function 006EE2FC: RegDeleteValueA.ADVAPI32(006EE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dn), ref: 006EE3BF
Part of subcall function 006EE2FC: RegCloseKey.ADVAPI32(006EE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dn,006EE50A), ref: 006EE3C8

Strings

PromptOnSecureDesktop, xrefs: 006EE4F1, 006EE4F6, 006EE537, 006EE561
Dn, xrefs: 006EE498, 006EE4BD, 006EE41A, 006EE447, 006EE4C0, 006EE41D, 006EE459, 006EE45A, 006EE46C, 006EE49B

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop$Dn
API String ID: 4151426672-2952939467
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 6ecd8b87b80772f8a002a09d31838002b490e3a3e914eefbc39d5d96c760ecca
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 7741BAB1901394BAEB206F528C46FDB3F6EDB04764F148029FA09941D2E7B6CA50D6B9

Function 006EE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EDF6C: GetCurrentThreadId.KERNEL32 ref: 006EDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,006EA6AC), ref: 006EE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,006EA6AC), ref: 006EE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,006EA6AC), ref: 006EE819

Strings

PromptOnSecureDesktop, xrefs: 006EE840, 006EE845, 006EE87C, 006EE89B

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 38e582e900c9ff3951e4cf1036c137279629c0b02d1dc2472de33d233a4e05db
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 0B21EAF1A423417AE66077635C0BFDB3E1EDB65760F10002CBA0AA51D3EA56D45082B9

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 006E7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006E76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006E796D
RegCloseKey.ADVAPI32(?), ref: 006E797E

Strings

PromptOnSecureDesktop, xrefs: 006E76C5, 006E76CA, 006E76E5

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: a5968a76fc28105d66cebdf6ca9fbdc4f713fb9be4dfc1ab8adef3f8a5f3485a
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: C7110370A05289AFDB118FAEDC45FEFBF7AEF81304F140165F511EA291E6B18D408B60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 006E9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006E999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006E99BD
RegCloseKey.ADVAPI32(?), ref: 006E99C6

Strings

PromptOnSecureDesktop, xrefs: 006E9989, 006E998E, 006E99B0, 006E99D3

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 45e31c42573e0f217caeff6035439d11f2ccea26d22f28786ba6018c66e99220
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 83F0F6B2681208BBF7106B51EC07FDB3E2DDB94B10F100074FA05B9082F6E59E9082BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 006E28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006E28FA
gethostbyname.WS2_32(u6A), ref: 006E2906

Strings

time_cfg, xrefs: 006E28EB
u6A, xrefs: 006E28EC, 006E28F9, 006E2905

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: fa9cc74874ea4fc951c224d9e4bd57ab69b6574163e41e90b0ed7465bcb63900
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: E2E08C306052528FDB008B29F848AC637ABAF0A330F118181F040C32A0C7349CC09640

Function 006E69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006E69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 006E6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 006E6A3A
CloseHandle.KERNEL32(000000FF), ref: 006E6BD8

Part of subcall function 006EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,006E1DCF,?), ref: 006EEEA8
Part of subcall function 006EEE95: HeapFree.KERNEL32(00000000), ref: 006EEEAF

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 876ceefd37b8688be2c5da19b0d916379f81a2691cf6c5f27218bfa1526ca01d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 7B71357190126DEFDB108FA5CC80AEEBBBAFB04354F1045AAF515E6290D7309E92DF60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 006E417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006E41AB
GetLastError.KERNEL32 ref: 006E41B5
WaitForSingleObject.KERNEL32(?,?), ref: 006E41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006E41D9

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 09b89624fc6c1051cdbf0717199652f4a91ab3d9a9150d1b35613a702019c13c
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 66014C7651220AAFDF01DFA1ED84BEF3B6DEB18355F004061F901E2150DB70DA908BB5

Function 006E41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006E421F
GetLastError.KERNEL32 ref: 006E4229
WaitForSingleObject.KERNEL32(?,?), ref: 006E423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006E424D

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: a8326d53610f7aa24ff2328e6c5ebbd08087bd18e504ba1226bf982f552e0420
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 4E01E972511209AFDF01DFA1ED84BEE7B6DEB08355F108061FA01E2150DB70AA549BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 006EE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 006EE066

Strings

A, xrefs: 006EE037, 006EE03C
A, xrefs: 006EE036
A, xrefs: 006EE07F

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 31eb5f9f7b7f59bac6cde67c0cd88d910d484f38078e23d503a28f954589ef9c
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: BCF09631201752DBCB30CF26D884AC2B7EAFF15321B44862BE154C3260D3B5E8E9CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 006E8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006E83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 006E8477

Part of subcall function 006E69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 006E69E5
Part of subcall function 006E69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 006E6A26
Part of subcall function 006E69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 006E6A3A

Part of subcall function 006EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,006E1DCF,?), ref: 006EEEA8
Part of subcall function 006EEE95: HeapFree.KERNEL32(00000000), ref: 006EEEAF

Strings

PromptOnSecureDesktop, xrefs: 006E83B2, 006E83B7, 006E8483

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 72602e6fd30316aa79604930419cc075cb7a92b1bb7738768d98fcc026bf06e4
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 7E4196B290238AFFDB10EBA29D81DFF77AEEB00340F14446AF508D7191FA715A548B54

Function 006EE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,006EE859,00000000,00020119,006EE859,PromptOnSecureDesktop), ref: 006EE64D
RegCloseKey.ADVAPI32(006EE859,?,?,?,?,000000C8,000000E4), ref: 006EE787

Strings

PromptOnSecureDesktop, xrefs: 006EE637

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 5aa24a7e2aae3367eaec1bcf3839523e1fa27f217ded861692a09ce4c6928544
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 8C4137B2D0025DBFDF11AF95DC81DEEBBBAEB14304F104466F900A6251E3729A55CB64

Function 006EAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006EAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 006EB00D

Part of subcall function 006EAF6F: gethostname.WS2_32(?,00000080), ref: 006EAF83
Part of subcall function 006EAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 006EAFE6

Part of subcall function 006E331C: gethostname.WS2_32(?,00000080), ref: 006E333F
Part of subcall function 006E331C: gethostbyname.WS2_32(?), ref: 006E3349

Part of subcall function 006EAA0A: inet_ntoa.WS2_32(00000000), ref: 006EAA10

Strings

%OUTLOOK_BND_, xrefs: 006EB076, 006EB07B, 006EB0BE, 006EB0DD

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: f31e0ca66c7703fc96d2d2c6df0c9d0a7a6a481ec92bc3c099938086cecd3616
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: B041537290034CABDB65EFA1DC46EEF3B6DFF04304F24442AF92492152EB75E6548B58

Function 006E9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 006E9536
Sleep.KERNEL32(000001F4), ref: 006E955D

Strings

, xrefs: 006E94D9

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: eb1bc0d46b14176002b3c18f98ea6a476b397a217247a3141f1da91ee177880c
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: B741F5718053C5AEEB378B66D8887F63BE69F02314F2441A5D486972D2E6B44D82C771

Function 006EBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006EB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 006EBA3A
InterlockedIncrement.KERNEL32(?), ref: 006EBA94
GetTickCount.KERNEL32 ref: 006EBB79
GetTickCount.KERNEL32 ref: 006EBB99
InterlockedIncrement.KERNEL32(?), ref: 006EBE15
closesocket.WS2_32(00000000), ref: 006EBEB4

Strings

%FROM_EMAIL, xrefs: 006EBC7D

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: f7fd1cbddb449231b1c71726d046be1402d9e5760effb82d8f9056a912f36867
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: FB31B171801388DFDF25DFA6DC84AEE77BAEB48700F20406AFA2482161DB70DA85CF14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 006E709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006E70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006E70F4

Strings

|, xrefs: 006E70E6

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3842949b3b6fe2451c09667d9a301e924b2a0ce67e15df2437520d2a9468f578
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: C7113C7290539CEBDF11CFD5DC84ADEB7BEAB05301F1841A6E501E7190E6709B88EBA1

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 006E3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E2F88: GetModuleHandleA.KERNEL32(?), ref: 006E2FA1
Part of subcall function 006E2F88: LoadLibraryA.KERNEL32(?), ref: 006E2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006E31DA
HeapFree.KERNEL32(00000000), ref: 006E31E1

Memory Dump Source

Source File: 00000000.00000002.2038872801.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d0140186e823e0ae0f7f37513e77d73466cd0c3a2d84e3e0316d31c938e8cd96
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 5551AA3190139AAFCB019F65D8889EAB776FF15300F2441A8ED9687311E732DB59CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2038594977.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2038594977.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lYWiDKe1In.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: bvvnqaeq.exePID: 1772, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	0%
Total number of Nodes:	1574
Total number of Limit Nodes:	12

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\lYWiDKe1In.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

C:\Users\user\Desktop\lYWiDKe1In.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
P, xrefs: 00409DAA
\, xrefs: 00409D0C
", xrefs: 0040A189
", xrefs: 00409EDB
D, xrefs: 00409F8E
djiglggs, xrefs: 0040A389, 0040A397
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 0040A1D9

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\lYWiDKe1In.exe$C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$D$P$\$djiglggs
API String ID: 2089075347-874398138
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 005C003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005C024D

Strings

kernel32.dll, xrefs: 005C008F, 005C0095
cess, xrefs: 005C018D

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 6ecb9a989f5fd5804ff419ab53124b423b4e5802c40885b424a45b5415c66c11
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D2526974A01229DFDB64CF98C985BA8BBB1BF09304F1480D9E54DAB391DB30AE95DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 0048292E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00482956
Module32First.KERNEL32(00000000,00000224), ref: 00482976

Memory Dump Source

Source File: 0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0047E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_47e000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c4dfd540e5637bc2e5cee85e45973f869f5db8d59279cf8e37de62094fcefde4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7CF0C2316007116BD7203AB99A8DB6FB6E8AF49324F50092AE642A11C0CAB4EC454B64

Function 005C0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005C0223,?,?), ref: 005C0E19
SetErrorMode.KERNELBASE(00000000,?,?,005C0223,?,?), ref: 005C0E1E

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 62d43324511f6a0460b43ce37119c2a39e606a598f81983a70edaf776378af12
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 17D01231145128B7D7003AD4DC09BCD7F1CDF05B62F008411FB0DD9080C770994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 004825ED Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0048263E

Memory Dump Source

Source File: 0000000C.00000002.2039369993.000000000047E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0047E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_47e000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e9bb3173a4d00666d6a4603f96e719b23f32a09072679c703b8758cc468a13f9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F2112B79A00208EFDB01DF98CA85E99BBF5AF08350F058095F948AB362D375EA50DB84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 005C65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005C65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005C6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 005C6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 005C6652

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: e4b591e5d9bf9a23b4185c028bd8908f389d3e51b28772f659cf28a5733e3cd1
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 5911A3B1600219BFDB219FA5DC0AF9B3FA8FB047A5F104029F908E7251DBB1DE4087A4

Function 005C9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 005C9E6D
lstrcpy.KERNEL32(?,00000000), ref: 005C9FE1
lstrcat.KERNEL32(?,?), ref: 005C9FF2
lstrcat.KERNEL32(?,0041070C), ref: 005CA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 005CA054
DeleteFileA.KERNEL32(?), ref: 005CA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 005CA0D6
lstrcpy.KERNEL32 ref: 005CA12F
lstrlen.KERNEL32(00000022), ref: 005CA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 005C9F13

Part of subcall function 005C7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 005C7081

Part of subcall function 005C6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\xdcafaam,005C7043), ref: 005C6F4E
Part of subcall function 005C6F30: GetProcAddress.KERNEL32(00000000), ref: 005C6F55
Part of subcall function 005C6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005C6F7B
Part of subcall function 005C6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005C6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 005CA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005CA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 005CA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 005CA21B
GetDriveTypeA.KERNEL32(?), ref: 005CA265
lstrcat.KERNEL32(?,00000000), ref: 005CA29F
lstrcat.KERNEL32(?,00410A34), ref: 005CA2C5
lstrcat.KERNEL32(?,00000022), ref: 005CA2D9
lstrcat.KERNEL32(?,00410A34), ref: 005CA2F4
wsprintfA.USER32 ref: 005CA31D
lstrcat.KERNEL32(?,00000000), ref: 005CA345
lstrcat.KERNEL32(?,?), ref: 005CA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 005CA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 005CA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005CA1D1

Part of subcall function 005C9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 005C999D
Part of subcall function 005C9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005C99BD
Part of subcall function 005C9966: RegCloseKey.ADVAPI32(?), ref: 005C99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 005CA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 005CA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 005CA41D

Strings

", xrefs: 005CA142
\, xrefs: 005C9F73
P, xrefs: 005CA011
D, xrefs: 005CA1F5
", xrefs: 005CA2DF
", xrefs: 005CA3F0

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 605311580d601c62aa869f481e45bc355f100906f227cc821003a98aba95ce42
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: AAF12CB1C4025EAFDB21DBE09C4DFEE7FBCBB48704F1444AAE605E2141E7758A848B65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtTerminateProcess, xrefs: 004010F6
ntdll.dll, xrefs: 0040100D
RtlLengthSid, xrefs: 00401246
NtOpenProcessToken, xrefs: 004011D4
RtlInitUnicodeString, xrefs: 00401135
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtQueryInformationToken, xrefs: 00401262
NtDuplicateToken, xrefs: 004011F3
NtClose, xrefs: 004011B4
NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
RtlFreeSid, xrefs: 00401116
RtlNtStatusToDosError, xrefs: 00401194
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtSetInformationThread, xrefs: 00401155

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Tue, xrefs: 0040B233
Feb, xrefs: 0040B25D
Sep, xrefs: 0040B28E
Sun, xrefs: 0040B225
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sat, xrefs: 0040B24F
Thu, xrefs: 0040B241
Apr, xrefs: 0040B26B
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Aug, xrefs: 0040B287
Jul, xrefs: 0040B280
Jan, xrefs: 0040B256
May, xrefs: 0040B272
Mon, xrefs: 0040B22C
Wed, xrefs: 0040B23A
Oct, xrefs: 0040B295
Jun, xrefs: 0040B279
Dec, xrefs: 0040B2A3
Fri, xrefs: 0040B248

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$D
API String ID: 2976863881-2485478636
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 005C7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 005C7D21
GetUserNameA.ADVAPI32(?,?), ref: 005C7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005C7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 005C7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005C7DC0
EqualSid.ADVAPI32(?,?), ref: 005C7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 005C7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005C7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005C7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 005C7E12
LocalFree.KERNEL32(00000000), ref: 005C7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C7E35

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 005C7F49, 005C7F76, 005C7F8A, 005C7F8B
D, xrefs: 005C7D73

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$D
API String ID: 2976863881-2485478636
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: c49d6aa04595fe46029f050a9334c6865f743d1fad6fc124cde9088afc3bf3eb
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: D3A13B7290021DAFDB218FA1DD88FEEBFBDFB48340F148069E515E6150EB758A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
except_info, xrefs: 00406728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
va=%08X%08X uef=%p, xrefs: 00406595
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

data, xrefs: 0040A85E
quit, xrefs: 0040A86C
Too small respons, xrefs: 0040A9C9
AUTH LOGIN, xrefs: 0040A80C
helo %s, xrefs: 0040A803
ESMTP, xrefs: 0040AA38
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 005C7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005C7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005C7ACD
GetLengthSid.ADVAPI32(?), ref: 005C7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 005C7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005C7B1F
EqualSid.ADVAPI32(?,?), ref: 005C7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 005C7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005C7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005C7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 005C7B77
LocalFree.KERNEL32(00000000), ref: 005C7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C7B9A
GetAce.ADVAPI32(?,?,?), ref: 005C7BCA
EqualSid.ADVAPI32(?,?), ref: 005C7BF1
DeleteAce.ADVAPI32(?,?), ref: 005C7C0A
EqualSid.ADVAPI32(?,?), ref: 005C7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 005C7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005C7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 005C7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 005C7CE0
LocalFree.KERNEL32(00000000), ref: 005C7CEE

Strings

D, xrefs: 005C7AC3

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 9678d6fcf4565dc9d82125a869e2d242b8cad4716a3ba0218cfa40f8b89fce20
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 6981177190421EAFDB21CFA4DD88FEEBFB8BB08344F14806AE515E6150E7759A41CFA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$localcfg
API String ID: 237177642-1464199976
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
PDGu, xrefs: 0040139A
uac, xrefs: 00401628
, xrefs: 00401462
<, xrefs: 00401378
useless, xrefs: 0040161E
D, xrefs: 004015C6
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25
net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
loader_id, xrefs: 00401F4B, 00401F6B
start_srv, xrefs: 00401E6C
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 005C858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 005C865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 005C867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 005C86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 005C86B1

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 005C882F, 005C883C, 005C884C
", xrefs: 005C896C

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe
API String ID: 237177642-1720201223
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: eda82de5fce40262b0e7091062b969c76bf2bd22926c3d0b75b1dda65d28b9a0
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 6DC19E71900209BEEB11ABE4DC89FFF7FBDFB58300F14446AF605A6051EBB14A948B65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 005C14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005C1601
lstrlenW.KERNEL32(-00000003), ref: 005C17D8

Strings

, xrefs: 005C16C9
D, xrefs: 005C182D
@, xrefs: 005C15E7
<, xrefs: 005C15DF

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 67e1a7eb92e4ea1571c2d2b6b99d24187ff609102a9340f3ed215dcbaf1aa5af
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 4CF19DB15087419FD720DFA4C888FABBBE4FB8A300F10892DF59697291D7B4D944CB5A

Function 005C7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005C76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 005C7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 005C778F
___ascii_stricmp.LIBCMT ref: 005C78B4
RegCloseKey.ADVAPI32(?), ref: 005C794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 005C796D
RegCloseKey.ADVAPI32(?), ref: 005C797E
RegCloseKey.ADVAPI32(?), ref: 005C79AC
RegCloseKey.ADVAPI32(?), ref: 005C7A56

Part of subcall function 005CF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,005C772A,?), ref: 005CF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005C79F6
RegCloseKey.ADVAPI32(?), ref: 005C7A4D

Strings

", xrefs: 005C7800

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: c022033e79e86d34beae967185b11e0a5803016221f8480a280aea3903ce64e6
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 1DC19F7290420AAFDB219BE4DC49FEE7FB9FF49710F1440A9F504A6191EB719A848F60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 005C2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005C2CED
socket.WS2_32(00000002,00000002,00000011), ref: 005C2D07
htons.WS2_32(00000000), ref: 005C2D42
select.WS2_32 ref: 005C2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 005C2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005C2E62

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: ad6bcada282b585c50769673881b96fdb7f5b0e10af0f56ce44bc0b07f2f6330
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: B161CD71508309AFC320AFA4DC09F6BBFF8FB88741F10481DF985A6251D7B4D8808BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 15625d6cb101808bdea6f9395adb21b3a8eafb42943f0309c545178590061202
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: 15625d6cb101808bdea6f9395adb21b3a8eafb42943f0309c545178590061202
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%s@%s, xrefs: 0040B461
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%FROM_USER, xrefs: 0040B431
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 005C1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 005C202D
GetSystemInfo.KERNEL32(?), ref: 005C204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 005C206A
GetProcAddress.KERNEL32(00000000), ref: 005C2071
GetCurrentProcess.KERNEL32(?), ref: 005C2082
GetTickCount.KERNEL32 ref: 005C2230

Part of subcall function 005C1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 005C1E7C

Strings

work_srv, xrefs: 005C20C5
hi_id, xrefs: 005C217D, 005C2182, 005C219A
flags_upd, xrefs: 005C20A5, 005C20AA, 005C20E3
localcfg, xrefs: 005C2091, 005C2098, 005C20AB, 005C20E4, 005C20F3, 005C2119, 005C2138, 005C214E, 005C2166, 005C2183, 005C219B, 005C21B7, 005C21D7

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 66855945cb503caba2e9fbd1f3b13a383ae36782ebeaf6b3be5e962a0e56106f
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 4751E5B05003486FE330AFB58C8AF67BEECFB94704F04491DF99692142D7B9A944C765

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 005C3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 005C3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 005C3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 005C3095
RtlAllocateHeap.NTDLL(00000000), ref: 005C30B6
htons.WS2_32(00000035), ref: 005C30EF
inet_addr.WS2_32(?), ref: 005C30FA
gethostbyname.WS2_32(?), ref: 005C310D
HeapFree.KERNEL32(00000000), ref: 005C314D

Strings

iphlpapi.dll, xrefs: 005C3062, 005C3067, 005C3077

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 92ab64d8cf2010f0eab9abad36e649defe0c3385bd42d9d78dba06196f9f9ae2
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: B9314431A0060AAFDB119BF49C48FAE7FB8BF05761F188169E518E7290DB74DA41CB54

Function 005C958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005C95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005C95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 005C95DC
wsprintfA.USER32 ref: 005C9635
wsprintfA.USER32 ref: 005C9673
wsprintfA.USER32 ref: 005C96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 005C9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005C978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005C97D8

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: b4b4c1eab8f3a2d12ca5c5dafb8dd81f6cf35f9b0b265ae1aaf25ae501ba6174
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: E4A15CB1900249EFEB21DFE0DC89FDA3BACFB45741F10402AFA1596152E7B5D984CBA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 005C6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005C67C3
htonl.WS2_32(?), ref: 005C67DF
htonl.WS2_32(?), ref: 005C67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005C68F1
ExitProcess.KERNEL32 ref: 005C69BC

Strings

localcfg, xrefs: 005C6994
except_info, xrefs: 005C698F

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 8eee0d913537414b03bb2c6dad80c9cbd4da845d892c5d8637fb1c049bfab8ef
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: A6616F71940208AFDB609FA4DC45FEA7BF9FB48300F14806AF96DD2161DA759990CF54

Function 005CF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(005CCC84), ref: 005CF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 005CF5CE
closesocket.WS2_32(00000000), ref: 005CF5DC

Strings

time_cfg, xrefs: 005CF58A

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 0433abc04acec01eb0307ce898a0e9b29d2023356dc3412c4a007ab2734f1a89
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 19315C72900119AFDB10DFA5EC89EEE7BBDFF88310F10456AF915E3150E7709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 005C2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 005C2FA1
LoadLibraryA.KERNEL32(?), ref: 005C2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 005C2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005C3000
RtlAllocateHeap.NTDLL(00000000), ref: 005C3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 005C3032

Strings

dnsapi.dll, xrefs: 005C2F90

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: f326c08418cd090a13f3bc69f308ef3fd3d649f185a3b8fcadb49b9dcc287059
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 57213272941629BFCB219B95DC49EAEBFB8FF08B50F108429F905E7140D7B49E8187D4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 005C99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 005C9A18
GetThreadContext.KERNEL32(?,?), ref: 005C9A52
TerminateProcess.KERNEL32(?,00000000), ref: 005C9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 005C9A98
SetThreadContext.KERNEL32(?,00010002), ref: 005C9AB5
ResumeThread.KERNEL32(?), ref: 005C9AC2

Strings

D, xrefs: 005C9A10

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 346a49e883c37cc5af43a20f43d233c39085eb0c9f64ef66b53cd8124ab905cf
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1E2117B1A01219BFDB119BE1DC09FEFBFBCEF04750F404065BA19E1050E6758A84CAA4

Function 005C1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 005C1C18
LoadLibraryA.KERNEL32(004102C8), ref: 005C1C26
GetProcessHeap.KERNEL32 ref: 005C1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 005C1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 005C1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 005C1D02
FreeLibrary.KERNEL32(?), ref: 005C1D0B

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: ca81c766e7be34fb98d4b3dd5018c8da074eb4cceefb78e8ae34d6a052574671
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 9C315B32E00209AFCB119FE4DC88DAEBFB9FB46311B24447EF502A6111D7B54E80DB98

Function 005C6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 005C6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 005C6D22
GetLastError.KERNEL32 ref: 005C6DA7
CloseHandle.KERNEL32(?), ref: 005C6DB5
GetLastError.KERNEL32 ref: 005C6DD6
DeleteFileA.KERNEL32(?), ref: 005C6DE7
GetLastError.KERNEL32 ref: 005C6DFD

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 5271a8362eb28197a7c125b6023e1b1074db40d228efaff5a26fb905c291a54f
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 1E31C076A00249BFCB019FE49D49FDE7FB9FF88310F14846AE252E3251D7708A558BA1

Function 005C6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\xdcafaam,005C7043), ref: 005C6F4E
GetProcAddress.KERNEL32(00000000), ref: 005C6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005C6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005C6F92

Strings

\\.\pipe\xdcafaam, xrefs: 005C6F37
C:\Windows\SysWOW64\, xrefs: 005C6F30, 005C6F38, 005C6F65, 005C6F6C, 005C6F7A, 005C6F85, 005C6F91, 005C6FA9, 005C6FC6, 005C6FEC

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\xdcafaam
API String ID: 1082366364-2611547163
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 6d01b30e846e808e8166e6aaad716cbc2b3fc7db19a24cc78be5542706369c85
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 102165217443447EF3225370AC8DFFB2E4CAB96720F0840ADF400E6482DAD989D6C7AD

Function 005CAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 005CAAE5

Strings

localcfg, xrefs: 005CAD72
, xrefs: 005CABB3

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 38905ff970d9c85d292d4723963457ca71e64c8c7b3f504027a336c6d447b876
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: AF713C71A0030DAEDF218BD4EC86FEE3F69BB4070DF24442EF906A6091DA759D848757

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 005CE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CDF6C: GetCurrentThreadId.KERNEL32 ref: 005CDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 005CE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,005C6128), ref: 005CE950
lstrcmp.KERNEL32(?,00000008), ref: 005CE989

Strings

A, xrefs: 005CE960, 005CE965
A, xrefs: 005CE8C6, 005CE8CD, 005CE936, 005CE998
A, xrefs: 005CE9A0

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: bd359cfc9f2a41067fd7d28a711b3da3d08bf6404d325d93e03ddac0379cea52
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 9B319C316007069FDB718FA4C88AFA67FE8FB09720F10892EF59687551D374E880CB91

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 005C6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 005C6E19

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 0505c21ca243ff8bd3ee9f9280304eb518ef4e1832a305047d61e0de66b51bb9
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 86211D76104119BFDB109BE1EC49FDF7FADEB497A1B20842AF502D1091EB70DB4096B4

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 005C92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005C92E2
wsprintfA.USER32 ref: 005C9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005C9375
lstrlen.KERNEL32(?,?,00000000), ref: 005C9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 005C9394
CloseHandle.KERNEL32(00000000), ref: 005C939B

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 9bcbe30d9665cc0210447c41846a716e52c23e3cb66d2991f34ea3df43fc0f4e
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 961172B17401157FE72167B1EC0EFEF3E6DEBC8B10F008069BB09A5091EEB44A4187A4

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 005CC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005CC6B4
InterlockedIncrement.KERNEL32(005CC74B), ref: 005CC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,005CC747), ref: 005CC728
CloseHandle.KERNEL32(00000000,?,005CC747,00413588,005C8A77), ref: 005CC733

Strings

localcfg, xrefs: 005CC544

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 9ed7ff96c3bf4929f8820d806d4a95f345e797d2e991db7f095f7e5334fd265d
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: C7512FB1A01B458FD7649FA9C6C5A26BFE9FB48300B50593EE18BC7A90D774F844CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe
API String ID: 124786226-1056034784
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 005CE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,005CE50A,00000000,00000000,00000000,00020106,00000000,005CE50A,00000000,000000E4), ref: 005CE319
RegSetValueExA.ADVAPI32(005CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005CE38E
RegDeleteValueA.ADVAPI32(005CE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D\), ref: 005CE3BF
RegCloseKey.ADVAPI32(005CE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D\,005CE50A), ref: 005CE3C8

Strings

D\, xrefs: 005CE2FC

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: D\
API String ID: 2667537340-318309186
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 3a03be5e8047c8b5b9aab3c11619027a69032d62e33637b8d1325c8dc64cf899
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 5B214971A00219AFDF209FE5EC8AFEE7F69EF09B50F008425F904A6151E271AA5497A0

Function 005C71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005C71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005C7228
LocalFree.KERNEL32(?,?,?), ref: 005C7286
wsprintfA.USER32 ref: 005C729D

Strings

|, xrefs: 005C721A

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: b3b18c8fc88ffacbe45da13e36758933acca8e4e874692846961bf24f66fcdca
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 6931F676904209AFDB01DFA8D849FDA7BACEF08314F14806AB959DB101EB75DA488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 005CB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005CB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005CB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 005CB548
GetTimeZoneInformation.KERNEL32(?), ref: 005CB590
wsprintfA.USER32 ref: 005CB61E

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 4a9fbe775a5e59ed3eb627d0cde722eab1158ff4899fe0f45788086f672f95c9
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 70512EB1D0021DAEDF14DFD5D8899EEBBB9BF48304F10812AF501A6150E7B84AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 005C62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005C6303
LoadLibraryA.KERNEL32(?), ref: 005C632A
GetProcAddress.KERNEL32(00000000,?), ref: 005C63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005C6405

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 8239c9f265b973da40c727b2487653b671d48f56a52001f5266edb54c2395766
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 8C415B71A0020AAFDB14CF98C884FA9BBB8FF04754F24896DE815D7290E775EE41DB90

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 005C93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005C93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 005C93CD
CharToOemA.USER32(?,?), ref: 005C93DB
wsprintfA.USER32 ref: 005C9410

Part of subcall function 005C92CB: GetTempPathA.KERNEL32(00000400,?), ref: 005C92E2
Part of subcall function 005C92CB: wsprintfA.USER32 ref: 005C9350
Part of subcall function 005C92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005C9375
Part of subcall function 005C92CB: lstrlen.KERNEL32(?,?,00000000), ref: 005C9389
Part of subcall function 005C92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 005C9394
Part of subcall function 005C92CB: CloseHandle.KERNEL32(00000000), ref: 005C939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 005C9448

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: f7759ef1b67d1a7cde733f0a7b17b90feabb90ece943a9efc0ca329e29b69166
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 450140F69001197BDB21A7A19D8DFDF3B7CEB95701F0040A5BB49E2080EAB496C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 005C28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005C28FA
gethostbyname.WS2_32(u6A), ref: 005C2906

Strings

time_cfg, xrefs: 005C28EB
u6A, xrefs: 005C28EC, 005C28F9, 005C2905

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: fc47509bc1e8080fe20292609598641e6ed40e7f374ce30b408a7adf11002093
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 8BE082306082218FCB008B28F848ACA3BA4AF0A330F008188F080C32A1C7349CC0AA80

Function 005C69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005C69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 005C6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 005C6A3A
CloseHandle.KERNEL32(000000FF), ref: 005C6BD8

Part of subcall function 005CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005C1DCF,?), ref: 005CEEA8
Part of subcall function 005CEE95: HeapFree.KERNEL32(00000000), ref: 005CEEAF

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: d185c706df482f22f419515de25910c8f64503694aed0bfc6e85fba058ffa8be
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8D71F271900229EFDB109FA4CC85EEEBBB9FB08354F1045AAE515E6190D7349F92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 005C417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005C41AB
GetLastError.KERNEL32 ref: 005C41B5
WaitForSingleObject.KERNEL32(?,?), ref: 005C41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C41D9

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: d13877ea5bdddbf76327d4584d98a86b02b156fb5b8f3fea11a9710a9380139f
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 8101C27691110AAFDB01DF90ED88FEA7BA8BB18355F108065F901E2050D7709AA4CBA6

Function 005C41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005C421F
GetLastError.KERNEL32 ref: 005C4229
WaitForSingleObject.KERNEL32(?,?), ref: 005C423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005C424D

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 2f319d742f53deb00d87fa5ca943588ce300062b4879663a438d77c4d130c274
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 22019072911209AFDF01DF90EE85FEE7BACFB08356F108465F901E2050D770AA549BA6

Function 005CE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 005CE066

Strings

A, xrefs: 005CE07F
A, xrefs: 005CE036
A, xrefs: 005CE037, 005CE03C

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 09c7fa59e40d728810f64453ea078664598db1b32435db3c59c3002375a9ded7
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 99F06231200702DFCB30CFA5D889F82BBF9FB05321B44862EE154E3060D3B4A899CB95

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 005CE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,D\,00000000,00000000,00000000), ref: 005CE470
CloseHandle.KERNEL32(00000001,00000003), ref: 005CE484

Part of subcall function 005CE2FC: RegCreateKeyExA.ADVAPI32(80000001,005CE50A,00000000,00000000,00000000,00020106,00000000,005CE50A,00000000,000000E4), ref: 005CE319
Part of subcall function 005CE2FC: RegSetValueExA.ADVAPI32(005CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005CE38E
Part of subcall function 005CE2FC: RegDeleteValueA.ADVAPI32(005CE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D\), ref: 005CE3BF
Part of subcall function 005CE2FC: RegCloseKey.ADVAPI32(005CE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D\,005CE50A), ref: 005CE3C8

Strings

D\, xrefs: 005CE498, 005CE4BD, 005CE41A, 005CE447, 005CE4C0, 005CE41D, 005CE459, 005CE45A, 005CE46C, 005CE49B

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: D\
API String ID: 4151426672-318309186
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 5840193e4fafde13e52cd60ca4d295b26dbdcaa3791949865c6bc6b7acfbb356
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 8F41A7B6900215BEEB206AD18C8BFEF3F6CFB44764F14802DF90994092E6B58A50D6B5

Function 005C8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005C83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 005C8477

Part of subcall function 005C69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 005C69E5
Part of subcall function 005C69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 005C6A26
Part of subcall function 005C69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 005C6A3A

Part of subcall function 005CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005C1DCF,?), ref: 005CEEA8
Part of subcall function 005CEE95: HeapFree.KERNEL32(00000000), ref: 005CEEAF

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 005C848C, 005C84A1

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe
API String ID: 359188348-1056034784
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 9064207f5ca43699c6aa3ef49b2c1bbca8fa997dc7260a628207f5461678f47e
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 8F415EB290010ABEEF14ABE09DC5EFF7BADFB44344F14446EE504D6011EAB45A948B60

Function 005CAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005CAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 005CB00D

Part of subcall function 005CAF6F: gethostname.WS2_32(?,00000080), ref: 005CAF83
Part of subcall function 005CAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 005CAFE6

Part of subcall function 005C331C: gethostname.WS2_32(?,00000080), ref: 005C333F
Part of subcall function 005C331C: gethostbyname.WS2_32(?), ref: 005C3349

Part of subcall function 005CAA0A: inet_ntoa.WS2_32(00000000), ref: 005CAA10

Strings

%OUTLOOK_BND_, xrefs: 005CB076, 005CB07B, 005CB0BE, 005CB0DD

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 0cd10a0ddb6904b3bc7f547332a4d6e9155b8629803393065fb5af18d51a3682
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 7F416F7290024CAFDB21AFE0DC4AFEE3B6DFB48304F24442AB925A2152EA75D644CB54

Function 005C9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 005C9536
Sleep.KERNEL32(000001F4), ref: 005C955D

Strings

, xrefs: 005C94D9

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: f5c80694e5ea7d34836f571bf6b38ae086256ee85d3a492ee0bb64cf2d2cf50d
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 7B41E5B19083856EEF379BE4D88DFA67FA8BF42310F2841ADD482971A2D6B44D81C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 005CBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005CB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 005CBA3A
InterlockedIncrement.KERNEL32(?), ref: 005CBA94
GetTickCount.KERNEL32 ref: 005CBB79
GetTickCount.KERNEL32 ref: 005CBB99
InterlockedIncrement.KERNEL32(?), ref: 005CBE15
closesocket.WS2_32(00000000), ref: 005CBEB4

Strings

%FROM_EMAIL, xrefs: 005CBC7D

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 71d285b43b2509ce31685cac9afd8c0aa440465012197613ac93f0cbfa22c485
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 173158714002489FEF25DFE4DC8AFEA7BB8FB48700F20445AFA2592161EB759A85CB14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 005C709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005C70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005C70F4

Strings

|, xrefs: 005C70E6

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: c14b31e28fbe5a9015679bf25ece1a678b248c07e4d14bfc2eb9baa4998cb291
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: BD11D67290411CEBDB11CED4D884FDEBBBDBB08711F1881AAE501E6590D6709B88DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2039245342.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 005C3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C2F88: GetModuleHandleA.KERNEL32(?), ref: 005C2FA1
Part of subcall function 005C2F88: LoadLibraryA.KERNEL32(?), ref: 005C2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C31DA
HeapFree.KERNEL32(00000000), ref: 005C31E1

Memory Dump Source

Source File: 0000000C.00000002.2039438332.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5c0000_bvvnqaeq.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 4c09517f8bc0f175ff6ab90e4ad87102c72db5f21f921c0761e1ee14cdb1a58a
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 62519A7590024AAFCF019FA4D888AEABB75FF15304F148569EC9697211E7329A19CB90

Analysis Process: svchost.exePID: 5532, Parent PID: 1772COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1828
Total number of Limit Nodes:	18

Executed Functions

Function 02CBC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02CBCA4E
closesocket.WS2_32(?), ref: 02CBCB63
GetTempPathA.KERNEL32(00000120,?), ref: 02CBCC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02CBCCB4
WriteFile.KERNEL32(02CBA4B3,?,-000000E8,?,00000000), ref: 02CBCCDC
CloseHandle.KERNEL32(02CBA4B3), ref: 02CBCCED
wsprintfA.USER32 ref: 02CBCD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02CBCD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02CBCD89
CloseHandle.KERNEL32(?), ref: 02CBCD98
CloseHandle.KERNEL32(?), ref: 02CBCD9D
DeleteFileA.KERNEL32(?), ref: 02CBCDC4
CloseHandle.KERNEL32(02CBA4B3), ref: 02CBCDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02CBCFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02CBCFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02CBD033
lstrcatA.KERNEL32(?,04300108), ref: 02CBD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02CBD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02CBD171
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000), ref: 02CBD195
CloseHandle.KERNEL32(00000000), ref: 02CBD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02CBD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02CBD231
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02CBD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02CBD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD2C7
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02CBD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02CBD372
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02CBD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02CBD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD408
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02CBD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02CBD45B
CreateProcessA.KERNEL32(?,02CC0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02CBD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02CBD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02CBD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02CBD513
closesocket.WS2_32(?), ref: 02CBD56C
Sleep.KERNEL32(000003E8), ref: 02CBD577
ExitProcess.KERNEL32 ref: 02CBD583
wsprintfA.USER32 ref: 02CBD81F

Part of subcall function 02CBC65C: send.WS2_32(00000000,?,00000000), ref: 02CBC74B

closesocket.WS2_32(?), ref: 02CBDAD5

Strings

\, xrefs: 02CBD39D
localcfg, xrefs: 02CBCA89, 02CBCA93, 02CBCAC0, 02CBCAD2, 02CBCE4F, 02CBCE6F, 02CBD8D3, 02CBD8FC
wtm_r, xrefs: 02CBC97F
except_info, xrefs: 02CBD8CD, 02CBD8D2, 02CBD8FB
time_cfg, xrefs: 02CBC95B, 02CBC962, 02CBC971, 02CBC984
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 02CBCC10, 02CBCCF3, 02CBD975, 02CBD98E
drivers\, xrefs: 02CBD067
flags_upd, xrefs: 02CBCE4A
@, xrefs: 02CBD754
4, xrefs: 02CBD9F7
work_srv, xrefs: 02CBD607, 02CBD60F, 02CBD62C
srv_time, xrefs: 02CBCABB
lid_file_upd, xrefs: 02CBCE6A
.dat, xrefs: 02CBD0D7, 02CBD138, 02CBD1AE, 02CBD1D4, 02CBD28E, 02CBD308, 02CBD3CF, 02CBD441
.sys, xrefs: 02CBD0CC
local_time, xrefs: 02CBCACD
wtm_w, xrefs: 02CBC96C
wtm_c, xrefs: 02CBC956
\, xrefs: 02CBD3A7

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1520200621
Opcode ID: 41dcaa6fa5dfc202bd6d2e32e71ad948eca899f1ee92cdd6be750e8ab3113b4c
Instruction ID: 401d23fd977d41811e7ce09a8836fee2f505bc9de6f49426d84af0b5a3e695ec
Opcode Fuzzy Hash: 41dcaa6fa5dfc202bd6d2e32e71ad948eca899f1ee92cdd6be750e8ab3113b4c
Instruction Fuzzy Hash: 74B2E5B2D40248AFEB22AFA4DC48FEE7BBDEF44304F2445AAE546A3140D7309A55DF51

Function 02CB9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02CB9A7F
SetErrorMode.KERNELBASE(00000003), ref: 02CB9A83
SetUnhandledExceptionFilter.KERNEL32(02CB6511), ref: 02CB9A8A

Part of subcall function 02CBEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02CBEC5E
Part of subcall function 02CBEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02CBEC72
Part of subcall function 02CBEC54: GetTickCount.KERNEL32 ref: 02CBEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02CB9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02CB9ABA
GetCommandLineA.KERNEL32 ref: 02CB9AFD
lstrlenA.KERNEL32(?), ref: 02CB9B99
ExitProcess.KERNEL32 ref: 02CB9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02CB9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02CB9D7A
lstrcatA.KERNEL32(?,?), ref: 02CB9D8B
lstrcatA.KERNEL32(?,02CC070C), ref: 02CB9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02CB9DED
DeleteFileA.KERNEL32(00000022), ref: 02CB9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02CB9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02CB9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02CB9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02CB9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02CB9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02CB9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02CB9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02CB9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02CB9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02CBA038
lstrcatA.KERNEL32(00000022,02CC0A34), ref: 02CBA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02CBA072
lstrcatA.KERNEL32(00000022,02CC0A34), ref: 02CBA08D
wsprintfA.USER32 ref: 02CBA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02CBA0DE
lstrcatA.KERNEL32(00000022,?), ref: 02CBA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02CBA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02CBA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02CBA174
GetModuleFileNameA.KERNEL32(00000000), ref: 02CBA17B
GetDriveTypeA.KERNEL32(00000022), ref: 02CBA1B6
GetCommandLineA.KERNEL32 ref: 02CBA1E5

Part of subcall function 02CB99D2: lstrcpyA.KERNEL32(?,?,00000100,02CC22F8,00000000,?,02CB9E9D,?,00000022,?,?,?,?,?,?,?), ref: 02CB99DF
Part of subcall function 02CB99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02CB9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02CB9A3C
Part of subcall function 02CB99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02CB9E9D,?,00000022,?,?,?), ref: 02CB9A52

lstrlenA.KERNEL32(?), ref: 02CBA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02CBA3B7
GetLastError.KERNEL32 ref: 02CBA3ED
Sleep.KERNELBASE(000003E8), ref: 02CBA400
DeleteFileA.KERNELBASE(02CC33D8), ref: 02CBA407
CreateThread.KERNELBASE(00000000,00000000,02CB405E,00000000,00000000,00000000), ref: 02CBA42C
WSAStartup.WS2_32(00001010,?), ref: 02CBA43A
CreateThread.KERNELBASE(00000000,00000000,02CB877E,00000000,00000000,00000000), ref: 02CBA469
Sleep.KERNELBASE(00000BB8), ref: 02CBA48A
GetTickCount.KERNEL32 ref: 02CBA49F
GetTickCount.KERNEL32 ref: 02CBA4B7
Sleep.KERNELBASE(00001A90), ref: 02CBA4C3

Strings

djiglggs, xrefs: 02CBA389, 02CBA397
", xrefs: 02CBA189
P, xrefs: 02CB9DAA
", xrefs: 02CBA078
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 02CBA1D9
\, xrefs: 02CB9D0C
", xrefs: 02CB9EDB
D, xrefs: 02CB9F8E
%X%08X, xrefs: 02CBA0B0

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$D$P$\$djiglggs
API String ID: 2089075347-1203890814
Opcode ID: 4bee978c4814841bc4395cb7b89487013ef3eaaff7eacd7f792f6c1589f42e46
Instruction ID: 14f6a6221d2e71a74a82d9e85e13b232e45a11a1847a803b271e5958369fd0f3
Opcode Fuzzy Hash: 4bee978c4814841bc4395cb7b89487013ef3eaaff7eacd7f792f6c1589f42e46
Instruction Fuzzy Hash: AB5290B1C40299EFDB22DBA4CC49FEE7BBCAF44704F1445AAE609E2140E7709B449F61

Function 02CB199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02CB19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02CB1E9E), ref: 02CB19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02CB19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02CB19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02CB19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02CB1E9E), ref: 02CB1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A36
GetAdaptersInfo.IPHLPAPI(00000000,02CB1E9E,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02CB1E9E,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A5A
GetAdaptersInfo.IPHLPAPI(00000000,02CB1E9E,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02CB1E9E), ref: 02CB1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02CB1E9E), ref: 02CB1AA4

Strings

GetIfEntry, xrefs: 02CB19E4
localcfg, xrefs: 02CB19A3
Iphlpapi.dll, xrefs: 02CB19B7
GetBestInterface, xrefs: 02CB19EF
123.45.67.89, xrefs: 02CB19A6
GetAdaptersInfo, xrefs: 02CB19DC

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 624847db911dcfc396fdc72ea456349ece3a68d4f8718740b1aeacc93f37fe62
Instruction ID: d85e517c05a3fc745ca3dcd3422cf94e58d2dd49785634f95979104643e72530
Opcode Fuzzy Hash: 624847db911dcfc396fdc72ea456349ece3a68d4f8718740b1aeacc93f37fe62
Instruction Fuzzy Hash: 6A317271D80219EFDB129FE4CC989FEBBB9EF86605F280579E505A2110D7705B40CBA0

Function 02CB7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02CB7ABA
GetUserNameA.ADVAPI32(?,?), ref: 02CB7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02CC070C,?,?,?), ref: 02CB7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02CB7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02CB7B59
EqualSid.ADVAPI32(?,00000022), ref: 02CB7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02CB7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02CB7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02CB7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02CB7BAB
LocalFree.KERNEL32(00000000), ref: 02CB7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02CB7FC9,?,00000000), ref: 02CB7BCE

Strings

D, xrefs: 02CB7B0C
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 02CB7CE2, 02CB7D0F, 02CB7D23, 02CB7D24

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$D
API String ID: 2976863881-2485478636
Opcode ID: c40c4ecc1a3a40c266ea8becca6477525f18ae15383b379f9e5453fb26e1bfc1
Instruction ID: bb5206a15e77ceb9d113805e46fbd9c95661a32a55f9f1cc1355a492e5b57784
Opcode Fuzzy Hash: c40c4ecc1a3a40c266ea8becca6477525f18ae15383b379f9e5453fb26e1bfc1
Instruction Fuzzy Hash: C0A14C72D40219EBDF128FA4CC88FEEBBB9FF84745F144569E906E2140D7358A59CB60

Function 02CB7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02CB782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02CB7866
GetLengthSid.ADVAPI32(?), ref: 02CB7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02CB789A
GetSecurityDescriptorOwner.ADVAPI32(?,02CB7F63,?), ref: 02CB78B8
EqualSid.ADVAPI32(?,02CB7F63), ref: 02CB78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02CB78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02CB78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02CB7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02CB7910
LocalFree.KERNEL32(00000000), ref: 02CB7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02CB7933
GetAce.ADVAPI32(?,00000000,?), ref: 02CB7963
EqualSid.ADVAPI32(?,02CB7F63), ref: 02CB798A
DeleteAce.ADVAPI32(?,00000000), ref: 02CB79A3
EqualSid.ADVAPI32(?,02CB7F63), ref: 02CB79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02CB7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02CB7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02CB7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02CB7A79
LocalFree.KERNEL32(00000000), ref: 02CB7A87

Strings

D, xrefs: 02CB785C

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 452d8b164e64d095d1d80f74ebce7046c05324a8d2a6bfcc4b731f0ec0f4ef20
Instruction ID: bfbd857cc69c3f753bf4f6cfb9b8c4b510e806dd0c384ac9cebc6c418aec34d3
Opcode Fuzzy Hash: 452d8b164e64d095d1d80f74ebce7046c05324a8d2a6bfcc4b731f0ec0f4ef20
Instruction Fuzzy Hash: ED815B72D40219EBDB22CFA4CD84FEEBBB8AF89345F14456AE905E2140D7349749CBA0

Function 02CB8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02CB83F3
RegQueryValueExA.KERNELBASE(02CC0750,?,00000000,?,02CB8893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02CB8414
RegSetValueExA.KERNELBASE(02CC0750,?,00000000,00000004,02CB8893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02CB8441
RegCloseKey.ADVAPI32(02CC0750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02CB844A

Strings

localcfg, xrefs: 02CB8348
C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 02CB85C8, 02CB85D5, 02CB85E5

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe$localcfg
API String ID: 237177642-1464199976
Opcode ID: 67fd5228505ee12a72581335276086760899acdfe528f114b7f38e61d5a07c3a
Instruction ID: aab08783c7003d163566017b5393d10b8ac0ab3f0378aec85f2f8123200c5dc3
Opcode Fuzzy Hash: 67fd5228505ee12a72581335276086760899acdfe528f114b7f38e61d5a07c3a
Instruction Fuzzy Hash: 4FC171B2D80149FEEB12AFA4DC84EEE7BBDEF44704F244665F905A2040E7709B949F61

Function 02CB1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02CB1DC6
GetSystemInfo.KERNELBASE(?), ref: 02CB1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02CB1E03
GetProcAddress.KERNEL32(00000000), ref: 02CB1E0A
GetCurrentProcess.KERNEL32(?), ref: 02CB1E1B
GetTickCount.KERNEL32 ref: 02CB1FC9

Part of subcall function 02CB1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02CB1C15

Strings

work_srv, xrefs: 02CB1E5E
localcfg, xrefs: 02CB1E2A, 02CB1E31, 02CB1E44, 02CB1E7D, 02CB1E8C, 02CB1EB2, 02CB1ED1, 02CB1EE7, 02CB1EFF, 02CB1F1C, 02CB1F34, 02CB1F50, 02CB1F70
hi_id, xrefs: 02CB1F16, 02CB1F1B, 02CB1F33
lid_file_upd, xrefs: 02CB1E25
IsWow64Process, xrefs: 02CB1DF2
born_date, xrefs: 02CB1EAD, 02CB1ECC
net_type, xrefs: 02CB1E87
kernel32, xrefs: 02CB1DF7
loader_id, xrefs: 02CB1F4B, 02CB1F6B
start_srv, xrefs: 02CB1E6C
flags_upd, xrefs: 02CB1E3E, 02CB1E43, 02CB1E7C

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 0ab8f4dbf566bf9200f4e44f825a2f9e0a77574c86ea3778bc5975535a015183
Instruction ID: 0489668755a40e24d9f60111f182a6a29c87b25845f72c3539e6d828e3454ea5
Opcode Fuzzy Hash: 0ab8f4dbf566bf9200f4e44f825a2f9e0a77574c86ea3778bc5975535a015183
Instruction Fuzzy Hash: 4B51E8B0944744AFE331AF758C89FA7BBECEF85748F48091DF54A82102D7B5A504CBA1

Function 02CB73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 02CB7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 02CB74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 02CB7528
___ascii_stricmp.LIBCMT ref: 02CB764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 02CB76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02CB7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02CB7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 02CB7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02CB77EF

Part of subcall function 02CBF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02CC22F8,000000C8,02CB7150,?), ref: 02CBF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02CB778F
RegCloseKey.KERNELBASE(?), ref: 02CB77E6

Strings

", xrefs: 02CB7599

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 51517919b90c4d82bc9712811147d2c364e221f5a5fb6e057cb685653936e8d1
Instruction ID: f7da85501f711f68ac6d2b0bc47e36bb2b7c846a5aea154fa4a8eafd1b400a5c
Opcode Fuzzy Hash: 51517919b90c4d82bc9712811147d2c364e221f5a5fb6e057cb685653936e8d1
Instruction Fuzzy Hash: 4FC18372900249AFEB139FA5DC48FEEBBBDEF85710F140495E904A6190EB71DA48DF60

Function 02CB675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 02CB677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 02CB679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 02CB67B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 02CB67BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 02CB67D3
ReadFile.KERNELBASE(000000FF,?,00000040,02CB8244,00000000,?,75920F10,00000000), ref: 02CB6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02CB681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 02CB683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02CB685C
ReadFile.KERNEL32(000000FF,?,00000028,02CB8244,00000000,?,75920F10,00000000), ref: 02CB688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 02CB6906
ReadFile.KERNEL32(000000FF,?,00000000,02CB8244,00000000,?,75920F10,00000000), ref: 02CB691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75920F10,00000000), ref: 02CB6971

Part of subcall function 02CBEC2E: GetProcessHeap.KERNEL32(00000000,02CBEA27,00000000,02CBEA27,00000000), ref: 02CBEC41
Part of subcall function 02CBEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02CBEC48

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 391e60646622d07998bf1afeef2a449ff7edec4723e05492cb0a575f0ef014af
Instruction ID: 9fc334a20d737c84cf3392172ec63d57f46f7ab196703426474e47e60fd60361
Opcode Fuzzy Hash: 391e60646622d07998bf1afeef2a449ff7edec4723e05492cb0a575f0ef014af
Instruction Fuzzy Hash: 1F71F871D00219EFDF168FA5CC80AEEBBB9FF48314F20456AE515A6290E7319E52DF60

Function 02CBF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02CBCA1D), ref: 02CBF34D
socket.WS2_32(00000002,00000001,00000000), ref: 02CBF367
closesocket.WS2_32(00000000), ref: 02CBF375

Strings

time_cfg, xrefs: 02CBF323

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: b365b9a87e2643c5a161c6a5d30e6bd0c5154e02a3030ebf905066a3a0caf457
Instruction ID: 8afe967b29ecaee55da4171effbdd27d50e27c3f0716f232bfc6103e73c09a77
Opcode Fuzzy Hash: b365b9a87e2643c5a161c6a5d30e6bd0c5154e02a3030ebf905066a3a0caf457
Instruction Fuzzy Hash: AC315E72940118ABDB11DFA5DC84AEEBBBCFF89314F10456AF915D3240E7709A518FA0

Function 02CB405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02CB4070
ExitProcess.KERNEL32 ref: 02CB4121

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: e1ef1fb60c88e8501a7fb835a186b5b0bc9138d12ae757897fa0899dd4655edc
Instruction ID: c15a4b2773a72ea1ad43db83eaacc5549746c143a89e49a95b93ee0c64d6fe8d
Opcode Fuzzy Hash: e1ef1fb60c88e8501a7fb835a186b5b0bc9138d12ae757897fa0899dd4655edc
Instruction Fuzzy Hash: CE51AEB1D44218FAEB22AAA08C85FFF7B7DEF50715F1001A5FA10B6181E7318A01DBA1

Function 02CB2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02CB2F01,?,02CB20FF,02CC2000), ref: 02CB2D3A
LoadLibraryA.KERNEL32(?), ref: 02CB2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02CB2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02CB2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02CB2D99
HeapAlloc.KERNEL32(00000000), ref: 02CB2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02CB2DCB

Strings

dnsapi.dll, xrefs: 02CB2D29
DnsQuery_A, xrefs: 02CB2D5B

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: b704abb95bfb1243d5db86f31a0365e8be8fb652bc436fc6157d9e141271d4f5
Instruction ID: defc6f2202987a6ef5fded376fd12aab68fd8be1d78fc10fdf9e8d31d6db08d2
Opcode Fuzzy Hash: b704abb95bfb1243d5db86f31a0365e8be8fb652bc436fc6157d9e141271d4f5
Instruction Fuzzy Hash: 62219D71D40626EBCB22AF65DC44AEEBBB8FF48B50F104556F805E3200D370AA82CBD1

Function 02CB80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02CB815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02CBA45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02CB8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02CBA45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02CB81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02CB8210

Part of subcall function 02CB675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 02CB677E
Part of subcall function 02CB675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 02CB679A
Part of subcall function 02CB675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 02CB67B0
Part of subcall function 02CB675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 02CB67BF
Part of subcall function 02CB675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 02CB67D3
Part of subcall function 02CB675C: ReadFile.KERNELBASE(000000FF,?,00000040,02CB8244,00000000,?,75920F10,00000000), ref: 02CB6807
Part of subcall function 02CB675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02CB681F
Part of subcall function 02CB675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 02CB683E
Part of subcall function 02CB675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02CB685C

Part of subcall function 02CBEC2E: GetProcessHeap.KERNEL32(00000000,02CBEA27,00000000,02CBEA27,00000000), ref: 02CBEC41
Part of subcall function 02CBEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02CBEC48

Strings

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe, xrefs: 02CB8225, 02CB823A

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe
API String ID: 124786226-1056034784
Opcode ID: e3bfc92cb4e8b7610648ed956e0d5c5df094c5c1df0c2d686900c4d6ef536796
Instruction ID: 01aded223def4c891f2e45614bf230b35321d982bf5a27ce73cbd452402bbde2
Opcode Fuzzy Hash: e3bfc92cb4e8b7610648ed956e0d5c5df094c5c1df0c2d686900c4d6ef536796
Instruction Fuzzy Hash: 94417FB2D41149BFEB12ABA4DD80EFE776DAF44704F240A6AE901E2100E7709F549B62

Function 02CB1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02CB1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02CB1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02CB1B20

Strings

Iphlpapi.dll, xrefs: 02CB1ACC
GetAdaptersAddresses, xrefs: 02CB1AE3

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 2f15ed765d5762bede05345f12fcf9af231ac819503379938a0e5cc97b2883c8
Instruction ID: 00b581cbc400786cb0a56b0bcf0c91fb436c9c526b418e0b5cd4d792ab5bafaa
Opcode Fuzzy Hash: 2f15ed765d5762bede05345f12fcf9af231ac819503379938a0e5cc97b2883c8
Instruction Fuzzy Hash: 9111D6B1E01128EFDB179BA9DC948EDFBBAEF84B10F284155E009E3104E7B04B40DB94

Function 02CBE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02CBE5F2,00000000,00020119,02CBE5F2,02CC22F8), ref: 02CBE3E6
RegQueryValueExA.ADVAPI32(02CBE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02CBE44E
RegQueryValueExA.ADVAPI32(02CBE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02CBE482
RegQueryValueExA.ADVAPI32(02CBE5F2,?,00000000,?,80000001,?), ref: 02CBE4CF
RegCloseKey.ADVAPI32(02CBE5F2,?,?,?,?,000000C8,000000E4), ref: 02CBE520

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 25873a0fa006667eea8f2012735bc30ce06198b7f639f8c27b29ed671f878d65
Instruction ID: 4bcbb85fa4db9c4696f6a6ddcda287dfa22a9e2f7bf22d72caa444f5c6bc497b
Opcode Fuzzy Hash: 25873a0fa006667eea8f2012735bc30ce06198b7f639f8c27b29ed671f878d65
Instruction Fuzzy Hash: 2D4106B2D40219AFEF12AFD4DC80EEEBBB9FF48704F544566E910A2150E3319A159FA0

Function 02CBF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02CBF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02CBF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02CBF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02CBF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02CBF2FD

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 23f6f73a0b43f296650bd815c0abb2650bedc93dfcdd173cb413842dc32fdf23
Instruction ID: 8edb832e54facaf98497fd41cd69ccda90e3f1465c501349d6a1722f85582e70
Opcode Fuzzy Hash: 23f6f73a0b43f296650bd815c0abb2650bedc93dfcdd173cb413842dc32fdf23
Instruction Fuzzy Hash: 9011FBB1A40248BAEB11DE94CD41F9E7FBCEB44751F004066BB04EA1D0E6B19A45CB94

Function 02CB1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02CB1AD4
Part of subcall function 02CB1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02CB1AE9
Part of subcall function 02CB1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02CB1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02CB1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02CB1C51

Strings

localcfg, xrefs: 02CB1BE7
hi_id, xrefs: 02CB1BE5

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 1b57044edacb201c0dd7a467af21b8f29e96229f99d0d9cda4288e75bc339789
Instruction ID: fd1bb52c113e50b9c12777d1882117a0e464efb68bfdfd71bd5b69a4b6da2704
Opcode Fuzzy Hash: 1b57044edacb201c0dd7a467af21b8f29e96229f99d0d9cda4288e75bc339789
Instruction Fuzzy Hash: 7F01D2B2A00518BFEB11DEF9C8D19EFBBBCEB44656F140436E606E3100D6B09E4496A0

Function 02CB1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02CB1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02CB1AD4
Part of subcall function 02CB1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02CB1AE9
Part of subcall function 02CB1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02CB1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02CB1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02CB1EFD,00000000,00000000,00000000,00000000), ref: 02CB1BB8

Strings

localcfg, xrefs: 02CB1B7B

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 97c322c057ff542d32f2f8da470e5d10ee8f2583752bc400b835a6451ebb3526
Instruction ID: 5a6dfefba50079dd7cc517308e3f300a29d1c224a0ab5e0880ec6f619229c1f5
Opcode Fuzzy Hash: 97c322c057ff542d32f2f8da470e5d10ee8f2583752bc400b835a6451ebb3526
Instruction Fuzzy Hash: 9C014FB7D00118BFE7019AE9C8819EFFABDAF48664F150561E605E7140D5705E044AE0

Function 02CB2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02CB2693
gethostbyname.WS2_32(00000001), ref: 02CB269F

Strings

time_cfg, xrefs: 02CB2684

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 3fcf8531fde7bef7e3b8824ef89658f704db78ce3b772ac4f2fb5119a50164a3
Instruction ID: 475293950cbeae67b43071745d9b81d417860a840db2195ab5d18dae63e90b6e
Opcode Fuzzy Hash: 3fcf8531fde7bef7e3b8824ef89658f704db78ce3b772ac4f2fb5119a50164a3
Instruction Fuzzy Hash: 42E0C230A040118FCB118B38F444BD977E4EF8A230F114681F840C7194C730DD819781

Function 02CBE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02CBDD05: GetTickCount.KERNEL32 ref: 02CBDD0F
Part of subcall function 02CBDD05: InterlockedExchange.KERNEL32(02CC36B4,00000001), ref: 02CBDD44
Part of subcall function 02CBDD05: GetCurrentThreadId.KERNEL32 ref: 02CBDD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,02CBA445), ref: 02CBE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,02CBA445), ref: 02CBE583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,02CBA445), ref: 02CBE5B2

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 1435975287f660dc2935d91a748ba1ac9fd4b4b40f96741477fa7470cc8cc6cc
Instruction ID: a085ba779416c8183a98e285669f26e6626130a512f7fbf98d7da4002b03ef80
Opcode Fuzzy Hash: 1435975287f660dc2935d91a748ba1ac9fd4b4b40f96741477fa7470cc8cc6cc
Instruction Fuzzy Hash: FF2129B29803007AF2227A716C55FDB3E1DDF95B20F600558FE0EB21C3EA51E514A9F2

Function 02CB877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02CB88A5

Part of subcall function 02CBF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02CBE342,00000000,7508EA50,80000001,00000000,02CBE513,?,00000000,00000000,?,000000E4), ref: 02CBF089
Part of subcall function 02CBF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02CBE342,00000000,7508EA50,80000001,00000000,02CBE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02CBF093

Strings

localcfg, xrefs: 02CB87CA, 02CB87CF, 02CB87FB, 02CB8835, 02CB8861
rresolv, xrefs: 02CB87F6, 02CB885C

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 14da9f5f169c4bbee016b674b44397e44bf154b81bf4cd8cd0706a60298f2438
Instruction ID: 73280c18617845be9879d5d66809ad92475c9e4a2f8cbcf80aa0853e1ad54410
Opcode Fuzzy Hash: 14da9f5f169c4bbee016b674b44397e44bf154b81bf4cd8cd0706a60298f2438
Instruction Fuzzy Hash: 2521E9319883156AF716B7A4AC46FEA379EDF54714F700A1DFD04D61C0EFA2864099E3

Function 02CB4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02CC22F8,02CB42B6,00000000,00000001,02CC22F8,00000000,?,02CB98FD), ref: 02CB4021
GetLastError.KERNEL32(?,02CB98FD,00000001,00000100,02CC22F8,02CBA3C7), ref: 02CB402C
Sleep.KERNEL32(000001F4,?,02CB98FD,00000001,00000100,02CC22F8,02CBA3C7), ref: 02CB4046

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 0fa28b66d247b501f699833a77f4b6f24d4a949f469155c2f3b629d5a282f817
Instruction ID: a8541dabc3d4b4a40b1f2b2cedc1480deb9079f0d4971cf5795dc5093fbbe9f8
Opcode Fuzzy Hash: 0fa28b66d247b501f699833a77f4b6f24d4a949f469155c2f3b629d5a282f817
Instruction Fuzzy Hash: A1F0A731648201AAD73A0A34BC9AB9A3265EFC1734F264B24F3B5E20D1C73049819B95

Function 02CBDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02CBDC19,?,00000104), ref: 02CBDB7F
lstrcpyA.KERNEL32(?,02CC28F8), ref: 02CBDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02CBDBC2

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: df666cf51c264c9eaac2052f3f630b7c78968aca92c1bdea0ac15acc37340425
Instruction ID: e7696e9e9c59e407ed029854d3005567928238f33459338106a2193146cdbc5a
Opcode Fuzzy Hash: df666cf51c264c9eaac2052f3f630b7c78968aca92c1bdea0ac15acc37340425
Instruction Fuzzy Hash: 17F09A70540209EBEF219F64ED89FE93B69AB00318F2046A4FB91A40D0D7F2D695CB64

Function 02CBEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02CBEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02CBEC72
GetTickCount.KERNEL32 ref: 02CBEC78

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 3b5e79bae9ae3467735004f3a8ff115f8655c93073b78601fe18d553433b8fe4
Instruction ID: afa31a867ef5dc8fc98f99efcf1fa37c84ea576e28318cb936188a4d39add3b2
Opcode Fuzzy Hash: 3b5e79bae9ae3467735004f3a8ff115f8655c93073b78601fe18d553433b8fe4
Instruction Fuzzy Hash: 96E09AF5C50104FFE701ABB4EC4AE6B77BCFB08314F610B50F911D6180DA709A148BA0

Function 02CB30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02CB30D8
gethostbyname.WS2_32(?), ref: 02CB30E2

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 13b6d9b4f5ebff286733588e3b052adbdbed1a793b75e194c3ff344d19dc1195
Instruction ID: 3ef064426c2a20eb6eb757dc6dc1c6efeaf93e098838ad8a63421cf511e5b85d
Opcode Fuzzy Hash: 13b6d9b4f5ebff286733588e3b052adbdbed1a793b75e194c3ff344d19dc1195
Instruction Fuzzy Hash: 8DE09272D00119ABCF00EBA8EC89FDA77ECFF04308F180561F905E3244EA34E9048BA0

Function 02CBEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02CBEBA0: GetProcessHeap.KERNEL32(00000000,00000000,02CBEC0A,00000000,80000001,?,02CBDB55,7FFF0001), ref: 02CBEBAD
Part of subcall function 02CBEBA0: HeapSize.KERNEL32(00000000,?,02CBDB55,7FFF0001), ref: 02CBEBB4

GetProcessHeap.KERNEL32(00000000,02CBEA27,00000000,02CBEA27,00000000), ref: 02CBEC41
RtlFreeHeap.NTDLL(00000000), ref: 02CBEC48

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: fe48cd07354a284587df3656ae64b5c5e9a8a543bb4a6698131d0bc37c002aad
Instruction ID: 8fc93f2b761b4a0e3d6f3e9c628047227e7735bf174fc676042712de932823bd
Opcode Fuzzy Hash: fe48cd07354a284587df3656ae64b5c5e9a8a543bb4a6698131d0bc37c002aad
Instruction Fuzzy Hash: 2DC01272846630ABC9522650BC0CFDBAB589F45A12F590909F405671508B60994046E5

Function 02CBEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02CBEBFE,7FFF0001,?,02CBDB55,7FFF0001), ref: 02CBEBD3
RtlAllocateHeap.NTDLL(00000000,?,02CBDB55,7FFF0001), ref: 02CBEBDA

Part of subcall function 02CBEB74: GetProcessHeap.KERNEL32(00000000,00000000,02CBEC28,00000000,?,02CBDB55,7FFF0001), ref: 02CBEB81
Part of subcall function 02CBEB74: HeapSize.KERNEL32(00000000,?,02CBDB55,7FFF0001), ref: 02CBEB88

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: cbe70f6c1a980fae68449f8734d01e8e1079caf897ff7b21af3ea61d451922d7
Instruction ID: d8568813f68b6417b04e282bff4236b2e6f1877f20a3bf9f7b3d91d00c33bf47
Opcode Fuzzy Hash: cbe70f6c1a980fae68449f8734d01e8e1079caf897ff7b21af3ea61d451922d7
Instruction Fuzzy Hash: 30C08072544220ABC60127A57C0CFDA7E94DF04752F140504F505C1260C73048508795

Function 02CBF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02CBCA44), ref: 02CBF476

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: cb5415beffd9ad7f56f01b37b570b8a1d25a6edb85eb04da61dffa18f407d1a8
Instruction ID: 6a594a2c41b714f3d8a0d618b47117b96d1496a0811d8d1f9f0e68a913694b8c
Opcode Fuzzy Hash: cb5415beffd9ad7f56f01b37b570b8a1d25a6edb85eb04da61dffa18f407d1a8
Instruction Fuzzy Hash: 5EF01C7220155AAB9B129E9ADC84DEB3BAEFFC9250B040526FA14D7210D631E8218FA0

Function 02CB1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02CB1992

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: e8d17e0f7b514321e88f2fda396f21e6758813658434d176ae66b448d88cd644
Instruction ID: a56aecfa1952b4343d2809ec431095c9614a7c7c8ce3dde694c9a69e83de0491
Opcode Fuzzy Hash: e8d17e0f7b514321e88f2fda396f21e6758813658434d176ae66b448d88cd644
Instruction Fuzzy Hash: 20D012675486316A52122759BC045BFBB9CDF496A2F21941AFC48C0550D734C9419B95

Function 02CBDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02CBDDB5

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: cfff1e7ef6ac8cf206fca2a7c551cc5b091141c5b64a77368ba368c9ca78891b
Instruction ID: c456503af1648f0070b71d7d018209f56cc8f634e37f9792060bec5fac80a612
Opcode Fuzzy Hash: cfff1e7ef6ac8cf206fca2a7c551cc5b091141c5b64a77368ba368c9ca78891b
Instruction Fuzzy Hash: 8CF01271604302CBCB22CE75A844696B7E4EFC6629F29492EE5D6D2140D730D995CB71

Non-executed Functions

Function 02CB637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02CB9816,EntryPoint), ref: 02CB638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02CB9816,EntryPoint), ref: 02CB63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02CB63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02CB63EB

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 465fe465d6a791068333d33e78abbe72a4fec56cc216e954424d9a962136c465
Instruction ID: 15c7667dcc60a07b15e5148d1dd398d57a69f6c08bf81d0ab2a84c2e0d7c22f0
Opcode Fuzzy Hash: 465fe465d6a791068333d33e78abbe72a4fec56cc216e954424d9a962136c465
Instruction Fuzzy Hash: CD1191B1A00219BFEB128F65DC49FDB3BACEF447A5F214524F909E6280D770DD108AA0

Function 02CB1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02CB1839,02CB9646), ref: 02CB1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02CB10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02CB10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02CB1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02CB1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02CB1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02CB1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02CB1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02CB119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02CB11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02CB11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02CB11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02CB121A

Strings

NtSetInformationThread, xrefs: 02CB1155
NtClose, xrefs: 02CB11B4
RtlInitUnicodeString, xrefs: 02CB1135
NtSetInformationToken, xrefs: 02CB1175
RtlNtStatusToDosError, xrefs: 02CB1194
NtFilterToken, xrefs: 02CB122B
RtlFreeSid, xrefs: 02CB1116
NtQueryInformationToken, xrefs: 02CB1262
NtOpenProcessToken, xrefs: 02CB11D4
NtTerminateProcess, xrefs: 02CB10F6
RtlExpandEnvironmentStrings_U, xrefs: 02CB10BC
NtDuplicateToken, xrefs: 02CB11F3
ntdll.dll, xrefs: 02CB100D
RtlLengthSid, xrefs: 02CB1246
RtlAllocateAndInitializeSid, xrefs: 02CB120F
RtlSetLastWin32Error, xrefs: 02CB10D6

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 24464db911a41442cf7e511d844e9f5b4be971f5fad59b2075ed9c731595d0dd
Instruction ID: 854c96362d53a414c21da4816eabe1b2dfd2c5e5d9380e3435ad46ae994b280b
Opcode Fuzzy Hash: 24464db911a41442cf7e511d844e9f5b4be971f5fad59b2075ed9c731595d0dd
Instruction Fuzzy Hash: 2D51AB71D8268196E71A8A6DBC507D237E86B88334F3C47AAD929D32D0D7F0C691CF91

Function 02CBB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 02CBB2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 02CBB2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02CBB2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 02CBB2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02CBB31A
GetTimeZoneInformation.KERNEL32(?), ref: 02CBB329
wsprintfA.USER32 ref: 02CBB3B7

Strings

Wed, xrefs: 02CBB23A
Sun, xrefs: 02CBB225
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02CBB3AF
Dec, xrefs: 02CBB2A3
Oct, xrefs: 02CBB295
Thu, xrefs: 02CBB241
May, xrefs: 02CBB272
Aug, xrefs: 02CBB287
Feb, xrefs: 02CBB25D
Jul, xrefs: 02CBB280
Mar, xrefs: 02CBB264
Apr, xrefs: 02CBB26B
Mon, xrefs: 02CBB22C
Jun, xrefs: 02CBB279
Sep, xrefs: 02CBB28E
Sat, xrefs: 02CBB24F
Tue, xrefs: 02CBB233
Nov, xrefs: 02CBB29C
Fri, xrefs: 02CBB248
Jan, xrefs: 02CBB256

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: b7968730132023cca89d309486c1dc711f91de3a5aa79805266362fe9783be13
Instruction ID: ba1b46f1b7d558e036b47b1e119ca9ced2cfe02506ce9f996f39b15fd92d1f4e
Opcode Fuzzy Hash: b7968730132023cca89d309486c1dc711f91de3a5aa79805266362fe9783be13
Instruction Fuzzy Hash: E45139B1E00A1DEACF15CFD5D9889EFBBB9FF48308F2045ADE605A6150D7344A89CB91

Function 02CB6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02CB654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02CB655C
htonl.WS2_32(?), ref: 02CB6578
htonl.WS2_32(?), ref: 02CB6587
wsprintfA.USER32 ref: 02CB659B
wsprintfA.USER32 ref: 02CB65DC
wsprintfA.USER32 ref: 02CB6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02CB668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02CB6696
wsprintfA.USER32 ref: 02CB66B0
wsprintfA.USER32 ref: 02CB66E7
wsprintfA.USER32 ref: 02CB66FF
wsprintfA.USER32 ref: 02CB671F
ExitProcess.KERNEL32 ref: 02CB6755

Strings

localcfg, xrefs: 02CB672D
except_info, xrefs: 02CB6728
12:08:32, xrefs: 02CB6535
Jan 13 2018, xrefs: 02CB653A
plgs:, xrefs: 02CB66AA
ver=%d date=%s %sc=%08x a=%p, xrefs: 02CB6547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02CB666B
%d=%p, xrefs: 02CB66F9
va=%08X%08X uef=%p, xrefs: 02CB6595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02CB65D6

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 751daa6041bd8bd05b93a82931806bf63519853473823b72a7fba2b8104a7b8a
Instruction ID: e40967196dbaa43e022164f84afde19f5196edafb63da69067fc1fd6e1d518b0
Opcode Fuzzy Hash: 751daa6041bd8bd05b93a82931806bf63519853473823b72a7fba2b8104a7b8a
Instruction Fuzzy Hash: 14614A72A40208EFEB619FB4DC45FEA77E9FF48300F248569F969D2121EA719950CF50

Function 02CBA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02CBA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 02CBA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 02CBA893
wsprintfA.USER32 ref: 02CBA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 02CBA8D2
wsprintfA.USER32 ref: 02CBA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 02CBA97C
wsprintfA.USER32 ref: 02CBA9B9

Strings

helo %s, xrefs: 02CBA803
localcfg, xrefs: 02CBAB0B
Error sending command (sent = %d/%d), xrefs: 02CBA8A7, 02CBA8DA
ehlo %s, xrefs: 02CBA7F5
Incorrect respons, xrefs: 02CBAB39
Too big smtp respons (%d bytes), xrefs: 02CBA9B1
quit, xrefs: 02CBA86C
rcpt to:<%s>, xrefs: 02CBA855
., xrefs: 02CBA8CA
AUTH LOGIN, xrefs: 02CBA80C
data, xrefs: 02CBA85E
ESMTP, xrefs: 02CBAA38
mail from:<%s>, xrefs: 02CBA848
Too small respons, xrefs: 02CBA9C9

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: fbbc86cfd6f13ca74b50bb4cee377ae89b9b1e6357672480e6de0351f4cd3337
Instruction ID: c79eddda36e174d6c517a8aa5d8980d87166812200a0f8e1a1c97a51f68068cf
Opcode Fuzzy Hash: fbbc86cfd6f13ca74b50bb4cee377ae89b9b1e6357672480e6de0351f4cd3337
Instruction Fuzzy Hash: 17A15A71984345EEEF238A58DC85FEE776EFF40708F240466F982A7080DB328A44CB55

Function 02CB1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02CB139A
lstrlenW.KERNEL32(-00000003), ref: 02CB1571

Strings

uac, xrefs: 02CB1628
D, xrefs: 02CB15C6
useless, xrefs: 02CB161E
PDGu, xrefs: 02CB139A
<, xrefs: 02CB1378
@, xrefs: 02CB1380
, xrefs: 02CB1462
wusa.exe, xrefs: 02CB1388
%systemroot%\system32\cmd.exe, xrefs: 02CB1316

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: bb7339478fc5b2c644789f1485b00b0d6300b21d07a3a84cdff827a875832a79
Instruction ID: e3b701aced8e04700a1641b6bc5698e8dd81a303e4096b9519dac0532ef3f632
Opcode Fuzzy Hash: bb7339478fc5b2c644789f1485b00b0d6300b21d07a3a84cdff827a875832a79
Instruction Fuzzy Hash: 80F19BB55083419FD321DF64C898BABB7E5FF88304F188A2DF99A97280D7B4D944CB52

Function 02CB2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 02CB2A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 02CB2A86
socket.WS2_32(00000002,00000002,00000011), ref: 02CB2AA0
htons.WS2_32(00000000), ref: 02CB2ADB
select.WS2_32 ref: 02CB2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02CB2B4A
htons.WS2_32(?), ref: 02CB2B71
htons.WS2_32(?), ref: 02CB2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02CB2BFB

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: fc6a80d91308c739bf87333de98924ff06e0bf234af8daa38b46f7214b2016cc
Instruction ID: 231a278d71a63d1037cf9892c48db0d225e13b1779bc63cee67a5acd13b9ebbb
Opcode Fuzzy Hash: fc6a80d91308c739bf87333de98924ff06e0bf234af8daa38b46f7214b2016cc
Instruction Fuzzy Hash: 0061E3B19047049FE7229F61DC48BABBBE8FF88796F100909FD8597250D7B4D9408BA3

Function 02CB704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 02CB70C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 02CB719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 02CB71B2
RegCloseKey.ADVAPI32(75920F10), ref: 02CB7208
RegCloseKey.ADVAPI32(75920F10), ref: 02CB7291
___ascii_stricmp.LIBCMT ref: 02CB72C2
RegCloseKey.ADVAPI32(75920F10), ref: 02CB72D0
RegCloseKey.ADVAPI32(75920F10), ref: 02CB7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02CB738D
RegCloseKey.ADVAPI32(75920F10), ref: 02CB73D8

Part of subcall function 02CBF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02CC22F8,000000C8,02CB7150,?), ref: 02CBF1AD

Strings

", xrefs: 02CB7227
, xrefs: 02CB7194

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 9aed3989b6529218227944e11c9b53c4d5dd1ce7b3048c0fe617b583286b228d
Instruction ID: a1c27577db0a49cd729fc2942366c60107012d698d5969edfbed26a5e7ddca7b
Opcode Fuzzy Hash: 9aed3989b6529218227944e11c9b53c4d5dd1ce7b3048c0fe617b583286b228d
Instruction Fuzzy Hash: B5B19172C44209EEDF169FA4DC44BEEB7B9EF84311F200566F905E6090EB719B88DB61

Function 02CBAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02CBAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02CBADA6

Part of subcall function 02CBAD08: gethostname.WS2_32(?,00000080), ref: 02CBAD1C
Part of subcall function 02CBAD08: lstrlenA.KERNEL32(00000000), ref: 02CBAD60
Part of subcall function 02CBAD08: lstrlenA.KERNEL32(00000000), ref: 02CBAD69
Part of subcall function 02CBAD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02CBAD7F

Part of subcall function 02CB30B5: gethostname.WS2_32(?,00000080), ref: 02CB30D8
Part of subcall function 02CB30B5: gethostbyname.WS2_32(?), ref: 02CB30E2

wsprintfA.USER32 ref: 02CBAEA5

Part of subcall function 02CBA7A3: inet_ntoa.WS2_32(?), ref: 02CBA7A9

wsprintfA.USER32 ref: 02CBAE4F
wsprintfA.USER32 ref: 02CBAE5E

Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02CBEF92
Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(?), ref: 02CBEF99
Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(00000000), ref: 02CBEFA0

Strings

%s%d, xrefs: 02CBAE58
%OUTLOOK_BND_, xrefs: 02CBAE0F, 02CBAE14, 02CBAE57, 02CBAE76
%OUTLOOK_HST, xrefs: 02CBAEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02CBAE9F
%OUTLOOK_MID, xrefs: 02CBAEAE
127.0.0.1, xrefs: 02CBADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02CBAE49

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 4acf31b53873843bceb1e17255ea76a28a549341e184b7d2c43fba3fd4030012
Instruction ID: d2f7b1c491c54931e8f4113f9c74ac763edee46dbb9c3eadd827b71c36f3b28c
Opcode Fuzzy Hash: 4acf31b53873843bceb1e17255ea76a28a549341e184b7d2c43fba3fd4030012
Instruction Fuzzy Hash: 1F412FB290024CABEF26EFA1DC45EEE3BADFF08700F24042AF91592151EA75E5549F50

Function 02CB2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02CB2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2E4F
htons.WS2_32(00000035), ref: 02CB2E88
inet_addr.WS2_32(?), ref: 02CB2E93
gethostbyname.WS2_32(?), ref: 02CB2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2EE3
HeapFree.KERNEL32(00000000,?,00000000,02CB2F0F,?,02CB20FF,02CC2000), ref: 02CB2EE6

Strings

iphlpapi.dll, xrefs: 02CB2DFB, 02CB2E00, 02CB2E10
GetNetworkParams, xrefs: 02CB2E28

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 08e0cc45c7690d919379e00470967f746cb5229f3d5528d1439b3e8781df82c1
Instruction ID: 38ab8149b19c4cdb37a7b72f26135a262689e72369165f8192e9b11d93fc0dac
Opcode Fuzzy Hash: 08e0cc45c7690d919379e00470967f746cb5229f3d5528d1439b3e8781df82c1
Instruction Fuzzy Hash: 9D31F379D40689ABDF129BBA8C48BEF7778AF40366F200615FC14E3290DB30D641CB52

Function 02CB9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02CB9DD7,?,00000022,?,?,00000000,00000001), ref: 02CB9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02CB9DD7,?,00000022,?,?,00000000,00000001), ref: 02CB936E
GetModuleFileNameA.KERNEL32(00000000,?,02CB9DD7,?,00000022,?,?,00000000,00000001), ref: 02CB9375
wsprintfA.USER32 ref: 02CB93CE
wsprintfA.USER32 ref: 02CB940C
wsprintfA.USER32 ref: 02CB948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02CB94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02CB9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02CB9571

Strings

runas, xrefs: 02CB9674

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: daea4ec20f55f8114133ec3623075fc53173339c24ec91f8188f85072ad53117
Instruction ID: 7c87905ecb8bd7c0fa0fe5e01db012d76493a24b7d10c34ca4382c9f2ee2d97b
Opcode Fuzzy Hash: daea4ec20f55f8114133ec3623075fc53173339c24ec91f8188f85072ad53117
Instruction Fuzzy Hash: 9FA19DB2980248EFEB229FA1CC85FDE3BADEF44741F200126FA1592151E775DA44DFA1

Function 02CB2011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB2078
GetTickCount.KERNEL32 ref: 02CB20D4
GetTickCount.KERNEL32 ref: 02CB20DB
GetTickCount.KERNEL32 ref: 02CB212B
GetTickCount.KERNEL32 ref: 02CB2132
GetTickCount.KERNEL32 ref: 02CB2142

Part of subcall function 02CBF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02CBE342,00000000,7508EA50,80000001,00000000,02CBE513,?,00000000,00000000,?,000000E4), ref: 02CBF089
Part of subcall function 02CBF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02CBE342,00000000,7508EA50,80000001,00000000,02CBE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02CBF093

Part of subcall function 02CBE854: lstrcpyA.KERNEL32(00000001,?,?,02CBD8DF,00000001,localcfg,except_info,00100000,02CC0264), ref: 02CBE88B
Part of subcall function 02CBE854: lstrlenA.KERNEL32(00000001,?,02CBD8DF,00000001,localcfg,except_info,00100000,02CC0264), ref: 02CBE899

Part of subcall function 02CB1C5F: wsprintfA.USER32 ref: 02CB1CE1

Strings

localcfg, xrefs: 02CB2070, 02CB2160, 02CB2186, 02CB2194, 02CB21E4
rbl_ip, xrefs: 02CB218F
rbl_bl, xrefs: 02CB2181
ip, xrefs: 02CB207A, 02CB20D6
net_type, xrefs: 02CB21DF

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip$ip
API String ID: 3976553417-1099056323
Opcode ID: 37758e6e94d6164e7725b428d2643f6660a4fe3438e7a01cdf48009e0dcbc8e3
Instruction ID: b40f26c2590e04b44e7a19fab387419ba65aeb31a415ccd12f6e2d2acef372d1
Opcode Fuzzy Hash: 37758e6e94d6164e7725b428d2643f6660a4fe3438e7a01cdf48009e0dcbc8e3
Instruction Fuzzy Hash: B7515470D843458EE72AEF30FC45BD67BE9AF40324F200A1EEE0586198DBB09654DB93

Function 02CBB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02CBB467

Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02CBEF92
Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(?), ref: 02CBEF99
Part of subcall function 02CBEF7C: lstrlenA.KERNEL32(00000000), ref: 02CBEFA0

Strings

%DATE, xrefs: 02CBB4D2
%FROM_USER, xrefs: 02CBB431
%s@%s, xrefs: 02CBB461
%TO_HASH, xrefs: 02CBB4B0
%P5DATE, xrefs: 02CBB4F2
%M5DATE, xrefs: 02CBB50F
%TO_DOMAIN, xrefs: 02CBB44B
%FROM_DOMAIN, xrefs: 02CBB41E
%TO_USER, xrefs: 02CBB488
%FROM_EMAIL, xrefs: 02CBB3E9
%TO_EMAIL, xrefs: 02CBB473

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: aafd7259fea1c9dcc29bbc70b9d6699a23b566b997a09a41f79ffc24dd17d415
Instruction ID: 77b31fa4e8302d7af09eff4a89557acd1b557a20e7821638c752615fb6b4938a
Opcode Fuzzy Hash: aafd7259fea1c9dcc29bbc70b9d6699a23b566b997a09a41f79ffc24dd17d415
Instruction Fuzzy Hash: 7A4162B294011CBEEF02AAA4CCC5DFF7B6DEF49648F240029F905A2100DB75AE149BB1

Function 02CBC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02CBA4C7: GetTickCount.KERNEL32 ref: 02CBA4D1
Part of subcall function 02CBA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02CBA4FA

GetTickCount.KERNEL32 ref: 02CBC31F
GetTickCount.KERNEL32 ref: 02CBC32B
GetTickCount.KERNEL32 ref: 02CBC363
GetTickCount.KERNEL32 ref: 02CBC378
GetTickCount.KERNEL32 ref: 02CBC44D
InterlockedIncrement.KERNEL32(02CBC4E4), ref: 02CBC4AE
CreateThread.KERNEL32(00000000,00000000,02CBB535,00000000,?,02CBC4E0), ref: 02CBC4C1
CloseHandle.KERNEL32(00000000,?,02CBC4E0,02CC3588,02CB8810), ref: 02CBC4CC

Strings

localcfg, xrefs: 02CBC2DD

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 9b6dbeb311451052d27a6a9ffb0bbdfe3acd028f2d4d103e11eb098d85ec745a
Instruction ID: 004e874a3ce184f237792d32e7e8d7e6d6f42fd096e55b2361a3b64bfffbc195
Opcode Fuzzy Hash: 9b6dbeb311451052d27a6a9ffb0bbdfe3acd028f2d4d103e11eb098d85ec745a
Instruction Fuzzy Hash: 1F5149B1A00B418FD7258F6AC5C466ABBE9FF88304B90593ED18BC7A90D774EA44CF14

Function 02CBBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02CBBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02CBBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02CBBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02CBBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02CBBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02CBBF94

Strings

smtp_herr, xrefs: 02CBBE46, 02CBBF62
smtp_retr, xrefs: 02CBBE61, 02CBBF8C
smtp_ban, xrefs: 02CBBE55, 02CBBF77

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 235925a32c624c6d9a2ee82d98b0e58f88171569813879fdfa7a868e921890b0
Instruction ID: 46df23734e7f17bc5b5fe990c14cb8cc3766a4215ac5e637b2b7fc9eee31ec9f
Opcode Fuzzy Hash: 235925a32c624c6d9a2ee82d98b0e58f88171569813879fdfa7a868e921890b0
Instruction Fuzzy Hash: FF51B379A0065AEFDB129F65C884BDEBBB9AF4474CF544069EC429B210D731EE41CF90

Function 02CB6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6A7D
GetDiskFreeSpaceA.KERNEL32(02CB9E9D,02CB9A60,?,?,?,02CC22F8,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02CB9A60,?,?,02CB9E9D), ref: 02CB6B80
GetLastError.KERNEL32(?,?,?,02CB9A60,?,?,02CB9E9D,?,?,?,?,?,02CB9E9D,?,00000022,?), ref: 02CB6B96

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: eff7fa0bb2bf326203ea6323b1aa801ba9070c925fc1d7d98d682023dff88abe
Instruction ID: 939646af4f8fb5830a3b0602be5593180e257c3643ba32b515db03ad04b96b77
Opcode Fuzzy Hash: eff7fa0bb2bf326203ea6323b1aa801ba9070c925fc1d7d98d682023dff88abe
Instruction Fuzzy Hash: 7131C2B2D40249AFDB029FA4CC44BDEBB7DEF84310F254566E651A3240D7309A559FA1

Function 02CB6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02CBD7C3), ref: 02CB6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02CBD7C3), ref: 02CB6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02CB6FE8
LocalFree.KERNEL32(00000120), ref: 02CB701F
wsprintfA.USER32 ref: 02CB7036

Strings

/%d, xrefs: 02CB7030
|, xrefs: 02CB6FB3

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 4976cd0daf7671255a805addcc43a17bc0687c560aed2bf475b2a12e2157fead
Instruction ID: cbbd5c479e9d98ed1727360f4cc27822194581e7cf945274dee0ba40ba36af6a
Opcode Fuzzy Hash: 4976cd0daf7671255a805addcc43a17bc0687c560aed2bf475b2a12e2157fead
Instruction Fuzzy Hash: 3A311872900218EBDB02DFA9D848BDA7BBCEF04314F148166F859DB201EB35D718CB94

Function 02CB6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02CC22F8,000000E4,02CB6DDC,000000C8), ref: 02CB6CE7
GetProcAddress.KERNEL32(00000000), ref: 02CB6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02CB6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02CB6D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02CB6CDD
C:\Windows\SysWOW64\, xrefs: 02CB6CC9, 02CB6CD1, 02CB6CFE, 02CB6D05, 02CB6D13, 02CB6D1E, 02CB6D2A, 02CB6D42, 02CB6D5F, 02CB6D85
kernel32, xrefs: 02CB6CE2

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 9131bcdcfae397ad2b691cc55894fa5231a51363966202952530f2bcd5f0fa48
Instruction ID: 5c4c2d433089300642e9fd82e9b720362311d8fb77f8a877eaa7ee99ecde5216
Opcode Fuzzy Hash: 9131bcdcfae397ad2b691cc55894fa5231a51363966202952530f2bcd5f0fa48
Instruction Fuzzy Hash: 672135A1A80280B9F72356328C88FF77F4D8F82A05F3C054CFD04A6181CB958646A6A6

Function 02CB977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02CB9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02CC22F8), ref: 02CB97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02CC22F8), ref: 02CB97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02CC22F8), ref: 02CB97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02CC22F8), ref: 02CB9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02CC22F8), ref: 02CB984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02CC22F8), ref: 02CB985B

Strings

D, xrefs: 02CB97A9

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: f03c3fec032f6cc52a4729d05a14726c1f62c2abcdaacf874cd6520d23b6b31d
Instruction ID: 03251d50061368004199ceca622d1dbd42d7fa0cc6f746a1d2512f4ba806ed01
Opcode Fuzzy Hash: f03c3fec032f6cc52a4729d05a14726c1f62c2abcdaacf874cd6520d23b6b31d
Instruction Fuzzy Hash: 412127B1D41229ABDF229FA1DC49FEFBBBCEF09654F400561FA19E1140EB309654CEA0

Function 02CBE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02CBDD05: GetTickCount.KERNEL32 ref: 02CBDD0F
Part of subcall function 02CBDD05: InterlockedExchange.KERNEL32(02CC36B4,00000001), ref: 02CBDD44
Part of subcall function 02CBDD05: GetCurrentThreadId.KERNEL32 ref: 02CBDD53

Part of subcall function 02CBDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02CBDDB5

lstrcpynA.KERNEL32(?,02CB1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02CBEAAA,?,?), ref: 02CBE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02CBEAAA,?,?,00000001,?,02CB1E84,?), ref: 02CBE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02CBEAAA,?,?,00000001,?,02CB1E84,?,0000000A), ref: 02CBE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02CBEAAA,?,?,00000001,?,02CB1E84,?), ref: 02CBE94F

Strings

localcfg, xrefs: 02CBE8AB
flags_upd, xrefs: 02CBE8A7

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 3e2fac98ff432674ac442f0bcdeaaa6ff3c0978327c8bcf6b528954b20a41653
Instruction ID: d1a2ded7a9d274fb4595d0a7899c0562b85a978097c51020c38ea2e911fb6d7d
Opcode Fuzzy Hash: 3e2fac98ff432674ac442f0bcdeaaa6ff3c0978327c8bcf6b528954b20a41653
Instruction Fuzzy Hash: 48511E72D0020AAFCB12EFA8C9849EEBBF9FF48704F54456AE405A7210DB35EA55DF50

Function 02CB6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02CB6BB2

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 6aead6e2e06316a931822bb36265f3a724ae52ae9cb861945e4bc7fb7dd33f64
Instruction ID: c3d0a60755aec76824c735c04e918b03def455f5726220aff689a1b44bf354cb
Opcode Fuzzy Hash: 6aead6e2e06316a931822bb36265f3a724ae52ae9cb861945e4bc7fb7dd33f64
Instruction Fuzzy Hash: 3E216D72904515FEDB126BA1ED48EDF3BACEF44766F304A15F502E2080EB31DA10EAB4

Function 02CB9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02CC22F8), ref: 02CB907B
wsprintfA.USER32 ref: 02CB90E9
CreateFileA.KERNEL32(02CC22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02CB910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02CB9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02CB912D
CloseHandle.KERNEL32(00000000), ref: 02CB9134

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: c075e56224cbbcbafa56fec906a12e8f8c22893636f8dc905c241f5dec39592d
Instruction ID: d35e4de69991218fa0fc05a41ccb7d9868908adcbe9db2b61d94dabb841d64c1
Opcode Fuzzy Hash: c075e56224cbbcbafa56fec906a12e8f8c22893636f8dc905c241f5dec39592d
Instruction Fuzzy Hash: 4011D6B6A40524BBFB266632DC0DFEF366EDFC4B11F108565FB0AA1144EA704E119FA0

Function 02CBDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CBDD0F
GetCurrentThreadId.KERNEL32 ref: 02CBDD20
GetTickCount.KERNEL32 ref: 02CBDD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,02CBE538,?,75920F10,?,00000000,?,02CBA445), ref: 02CBDD3B
InterlockedExchange.KERNEL32(02CC36B4,00000001), ref: 02CBDD44
GetCurrentThreadId.KERNEL32 ref: 02CBDD53

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: b0add324302be83abaf485d9823c299a17cfadd7469699b69033dd7e241be775
Instruction ID: 61881d5017ae6819a45f4305a07801810675dc87342f22352b1e52032074e39b
Opcode Fuzzy Hash: b0add324302be83abaf485d9823c299a17cfadd7469699b69033dd7e241be775
Instruction Fuzzy Hash: C8F0E272984204DFC7817B75F884B6D3BA4FB4532AF214A56E10AC3240C7205465DFB2

Function 02CBAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02CBAD1C
lstrlenA.KERNEL32(00000000), ref: 02CBAD60
lstrlenA.KERNEL32(00000000), ref: 02CBAD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02CBAD7F

Strings

LocalHost, xrefs: 02CBAD79

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 19e722ac93bc2d9e14d5360775cb1da87056108acceffea2d350a42e0128536e
Instruction ID: 758938926aa9f107139e91854539ad2ef588e400799a31ffd45d20c9a18a0706
Opcode Fuzzy Hash: 19e722ac93bc2d9e14d5360775cb1da87056108acceffea2d350a42e0128536e
Instruction Fuzzy Hash: A9012430C841899DDF334A38D844BF93F7AAFD775AF200156E4C09B115EF24868787A2

Function 02CB4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02CB98FD,00000001,00000100,02CC22F8,02CBA3C7), ref: 02CB4290
CloseHandle.KERNEL32(02CBA3C7), ref: 02CB43AB
CloseHandle.KERNEL32(00000001), ref: 02CB43AE

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 1a7e5f3d42e5a8d6bf329f9f02178394ba319f8eb67617fbb12d6c3ef9fe58ff
Instruction ID: f984c810c37b181165bf8936ced31ba04a625f48fa634e0d87d8d807a264d6f1
Opcode Fuzzy Hash: 1a7e5f3d42e5a8d6bf329f9f02178394ba319f8eb67617fbb12d6c3ef9fe58ff
Instruction Fuzzy Hash: F241BCB1C44209BADF22ABA1DD89FEFBFBDEF40324F204595F614A2181D7359640DBA0

Function 02CB6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02CB64CF,00000000), ref: 02CB609C
LoadLibraryA.KERNEL32(?,?,02CB64CF,00000000), ref: 02CB60C3
GetProcAddress.KERNEL32(?,00000014), ref: 02CB614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02CB619E

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 1389392ea2bdb40fa02db3bd4a4f86e32d5349d8e58b1609e78e80c47a6a393b
Instruction ID: deaa26e666a521f0812c1876703d1d033d44d64a3b89506aee58b9357b78ed33
Opcode Fuzzy Hash: 1389392ea2bdb40fa02db3bd4a4f86e32d5349d8e58b1609e78e80c47a6a393b
Instruction Fuzzy Hash: D8414871E00205EBDB15CF69CC84BAAB7B9FF54358F288169E815D7391E730EA41CB90

Function 02CB2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197745c19de072c0100c7e03b4bfe7fb40495d9915afd7f78629df2bb4f1e42d
Instruction ID: 9c51fc2ffe53fc2e0a885a210e20475045f97219f5dd536bd10ead54d727aabe
Opcode Fuzzy Hash: 197745c19de072c0100c7e03b4bfe7fb40495d9915afd7f78629df2bb4f1e42d
Instruction Fuzzy Hash: 9D319F71A40208ABDB229FA5CC81BFEB7F4FF48701F104456E948E7285E374DA41DB55

Function 02CB26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB272E
htons.WS2_32(00000001), ref: 02CB2752
htons.WS2_32(0000000F), ref: 02CB27D5
htons.WS2_32(00000001), ref: 02CB27E3
sendto.WS2_32(?,02CC2BF8,00000009,00000000,00000010,00000010), ref: 02CB2802

Part of subcall function 02CBEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02CBEBFE,7FFF0001,?,02CBDB55,7FFF0001), ref: 02CBEBD3
Part of subcall function 02CBEBCC: RtlAllocateHeap.NTDLL(00000000,?,02CBDB55,7FFF0001), ref: 02CBEBDA

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 50eb281a047b8130e50d6173b290b03b95900e5764fee297d9c0a68a0c7acc9c
Instruction ID: a524b734df9521e4979838854d811fd8543f83220d0fd8c8ab7d7dd92fc052ee
Opcode Fuzzy Hash: 50eb281a047b8130e50d6173b290b03b95900e5764fee297d9c0a68a0c7acc9c
Instruction Fuzzy Hash: F4316B38A803829FD7218F74D8A0BA17764EF59318F3A896DDC56CB312D732D492DB16

Function 02CB9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02CC22F8), ref: 02CB915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02CB9166
CharToOemA.USER32(?,?), ref: 02CB9174
wsprintfA.USER32 ref: 02CB91A9

Part of subcall function 02CB9064: GetTempPathA.KERNEL32(00000400,?,00000000,02CC22F8), ref: 02CB907B
Part of subcall function 02CB9064: wsprintfA.USER32 ref: 02CB90E9
Part of subcall function 02CB9064: CreateFileA.KERNEL32(02CC22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02CB910E
Part of subcall function 02CB9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02CB9122
Part of subcall function 02CB9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02CB912D
Part of subcall function 02CB9064: CloseHandle.KERNEL32(00000000), ref: 02CB9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02CB91E1

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 9dd0525d3434a8a76b3b3b4c19de882dd07138f20d1821e303b667a781c8e858
Instruction ID: 3eca145fe1ce0b323e2399565880d14b7ef3b49b740fc70225eb2c64fcef92b1
Opcode Fuzzy Hash: 9dd0525d3434a8a76b3b3b4c19de882dd07138f20d1821e303b667a781c8e858
Instruction Fuzzy Hash: 190192F6840158BBDB21A6619C4DFDF777CDB85B01F0001A1FB09E2040D67097858F71

Function 02CB2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02CB2491,?,?,?,02CBE844,-00000030,?,?,?,00000001), ref: 02CB2429
lstrlenA.KERNEL32(?,?,02CB2491,?,?,?,02CBE844,-00000030,?,?,?,00000001,02CB1E3D,00000001,localcfg,lid_file_upd), ref: 02CB243E
lstrcmpiA.KERNEL32(?,?), ref: 02CB2452
lstrlenA.KERNEL32(?,?,02CB2491,?,?,?,02CBE844,-00000030,?,?,?,00000001,02CB1E3D,00000001,localcfg,lid_file_upd), ref: 02CB2467

Strings

localcfg, xrefs: 02CB241F

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: cde6334ff6d995bebe95a8ca7f9a81a661ab3753912a212669148b1f13bb97d0
Instruction ID: ce043089475ea9813eee850b8e73890359977e64f6c70173d1288aebdfed5da2
Opcode Fuzzy Hash: cde6334ff6d995bebe95a8ca7f9a81a661ab3753912a212669148b1f13bb97d0
Instruction Fuzzy Hash: 62011A31600218EFCF12EF69CC819DE7BA9EF44364B11C826EC5997610E330EA508E91

Function 02CB1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02CB1CE1
wsprintfA.USER32 ref: 02CB1D6B

Strings

localcfg, xrefs: 02CB1C70
%u.%u.%u.%u.%s, xrefs: 02CB1CDB, 02CB1D65

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 3dbdfda8701e6244f89c4e57764859d5ebd67c126a65a46f6597307fb28a17b1
Instruction ID: 3d02178b037a1f8ecd554172fab20bf616cfe674d24101b0f4b298afc76a5244
Opcode Fuzzy Hash: 3dbdfda8701e6244f89c4e57764859d5ebd67c126a65a46f6597307fb28a17b1
Instruction Fuzzy Hash: 46419A729042989FDB22CFB98C54BEE3BED9F49311F280156F9A4D3142D674DA05CBA0

Function 02CBE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02CBDD05: GetTickCount.KERNEL32 ref: 02CBDD0F
Part of subcall function 02CBDD05: InterlockedExchange.KERNEL32(02CC36B4,00000001), ref: 02CBDD44
Part of subcall function 02CBDD05: GetCurrentThreadId.KERNEL32 ref: 02CBDD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,02CB5EC1), ref: 02CBE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,02CB5EC1), ref: 02CBE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,02CB5EC1), ref: 02CBE722

Strings

89ABCDEF, xrefs: 02CBE721

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 15835d95059220cfe3d6ce1572d0f7c1c2e22213e1ac42c5b16f681a6cd38545
Instruction ID: 4bca035a7eed4e498b5bab6df235c5dd86a56dc1a65afd2147693025022d01df
Opcode Fuzzy Hash: 15835d95059220cfe3d6ce1572d0f7c1c2e22213e1ac42c5b16f681a6cd38545
Instruction Fuzzy Hash: 8E31BE31A00719DFCB328E65D884BE777E4BF45B24F50492AE99587541E770E980CB91

Function 02CBE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02CBE2A3,00000000,00000000,00000000,00020106,00000000,02CBE2A3,00000000,000000E4), ref: 02CBE0B2
RegSetValueExA.ADVAPI32(02CBE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02CC22F8), ref: 02CBE127
RegDeleteValueA.ADVAPI32(02CBE2A3,?,?,?,?,?,000000C8,02CC22F8), ref: 02CBE158
RegCloseKey.ADVAPI32(02CBE2A3,?,?,?,?,000000C8,02CC22F8,?,?,?,?,?,?,?,?,02CBE2A3), ref: 02CBE161

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 0addd76fec9fa205159df822c55cdf9d1ae343920bdd92ab96d9a8892c9ad50f
Instruction ID: 75991e184b2b2db5482ed6c07576a53d844a846e0291bc3305e948e127be6fb4
Opcode Fuzzy Hash: 0addd76fec9fa205159df822c55cdf9d1ae343920bdd92ab96d9a8892c9ad50f
Instruction Fuzzy Hash: 06215C72E00219BBDF219EA5DC89EDF7FB9EF09B60F504161F904E6151E7318A14DBA0

Function 02CB3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02CBA3C7,00000000,00000000,000007D0,00000001), ref: 02CB3FB8
GetLastError.KERNEL32 ref: 02CB3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02CB3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02CB3FE6

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 446165683042c0ac4dd63b4a95a95799f90644dcdc4e6c65d2f2335b6811a943
Instruction ID: 97a224f2cf9b19421323529414ead5156a89f8f4122d00c9929fa0c0a87e28dc
Opcode Fuzzy Hash: 446165683042c0ac4dd63b4a95a95799f90644dcdc4e6c65d2f2335b6811a943
Instruction Fuzzy Hash: 0B01D77291110AABDF12DF94DD49BEE7B7CEF04355F104491F902E2040D7719A648BA2

Function 02CB3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02CBA3C7,00000000,00000000,000007D0,00000001), ref: 02CB3F44
GetLastError.KERNEL32 ref: 02CB3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02CB3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02CB3F72

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 70362fc9c8473a018c5993f278913f92fd3c1edac55d4f1204db16af92d46b81
Instruction ID: 8dbd384e0aed1dabf1bf4d0f5bc9a202a044a8c096d096c280bc3e8bb4c82d54
Opcode Fuzzy Hash: 70362fc9c8473a018c5993f278913f92fd3c1edac55d4f1204db16af92d46b81
Instruction Fuzzy Hash: 7401D072911149EBDB02DE90E988BEE7BBCEF04366F1045A5FA01E2040D7319A248BA2

Function 02CB4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB4E9E
GetTickCount.KERNEL32 ref: 02CB4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02CB4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02CB4EC3

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5438beaec442f01d2a28cac616b878f52ca36b57622b68bb0ac14f4b6e3642d9
Instruction ID: 50aba088aa61aaee8824b4b76f447ebc6558aad2adfb3093c5d7e3f72da0f915
Opcode Fuzzy Hash: 5438beaec442f01d2a28cac616b878f52ca36b57622b68bb0ac14f4b6e3642d9
Instruction Fuzzy Hash: 4EE07D3774424497D62022BAAC80F97B3499F86370F120A32F708C2142C657D45241F1

Function 02CB4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB4BDD
GetTickCount.KERNEL32 ref: 02CB4BEC
Sleep.KERNEL32(00000000,?,?,?,0301B114,02CB50F2), ref: 02CB4BF9
InterlockedExchange.KERNEL32(0301B108,00000001), ref: 02CB4C02

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: d047556c412b60e9e5cd329ea82ee2ad3c29c233f592e861151ac2181dbf8cf6
Instruction ID: ab679ff3144242497f02def6924d22fc188003749fba8ed1486b57cdaf2b75a6
Opcode Fuzzy Hash: d047556c412b60e9e5cd329ea82ee2ad3c29c233f592e861151ac2181dbf8cf6
Instruction Fuzzy Hash: A6E0CD3768561497CB2016B65C80FE6775CDF85772F170972F708D2141C556945141F5

Function 02CBA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CBA4D1
GetTickCount.KERNEL32 ref: 02CBA4E4
Sleep.KERNEL32(00000000,?,02CBC2E9,02CBC4E0,00000000,localcfg,?,02CBC4E0,02CC3588,02CB8810), ref: 02CBA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02CBA4FA

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 9acf606f8f21ec8034b7f107c4956c7ab8489f36695c78e52c5fe2866d8a2bc4
Instruction ID: fc606c08273d0b148612324c86cb861252d9f974f48bfa7d8815e6eb1548f7b0
Opcode Fuzzy Hash: 9acf606f8f21ec8034b7f107c4956c7ab8489f36695c78e52c5fe2866d8a2bc4
Instruction Fuzzy Hash: 89E07D33240204A7CB0117A6AC84FEE3388EF8D771F130521FF48D3140C617A55185F2

Function 02CB30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB3103
GetTickCount.KERNEL32 ref: 02CB310F
Sleep.KERNEL32(00000000), ref: 02CB311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02CB3128

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: f136d8743b0ee9a09e09c0556ff893698fbceb905992e24aeca2a86219d48f14
Instruction ID: a9126b957396c4928c4784d43be0fc1e1c977cf730a9b146fc18ee7f16e791c4
Opcode Fuzzy Hash: f136d8743b0ee9a09e09c0556ff893698fbceb905992e24aeca2a86219d48f14
Instruction Fuzzy Hash: 5BE02B31740215EFDB006B76AD45FC97B6EDFC4771F120872F201D3090C6504C1089B1

Function 02CB8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CB8D02
GetTickCount.KERNEL32 ref: 02CB8DA1

Strings

localcfg, xrefs: 02CB8D19

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 4faf23d74714d71d218e9eb8cbacf39fd6809becea464d741827cba6ca25977f
Instruction ID: 4fd8515486468ba77c5ab856cf8281e22149432ca217db868c81dc6e6d9fde22
Opcode Fuzzy Hash: 4faf23d74714d71d218e9eb8cbacf39fd6809becea464d741827cba6ca25977f
Instruction Fuzzy Hash: 4121D232A10516AFDB118F74D8806DABBBEEF60615F39079BD801D7101CB34EA40CB50

Function 02CBBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02CBBFD0
wsprintfA.USER32 ref: 02CBC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02CBC057

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: c7da1a8a7a24a3d6277771431fbabc1041b98b4c2757ebfca8aef9ad5893996a
Instruction ID: 1e3050edbc2be683c8872bf34cb6641f4627a490bf57c26ed067d676260c3c09
Opcode Fuzzy Hash: c7da1a8a7a24a3d6277771431fbabc1041b98b4c2757ebfca8aef9ad5893996a
Instruction Fuzzy Hash: 21119772500100FFDB429AA9CD48E567FA6FF88328B34819CF6188E126D633D863EB50

Function 02CB38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02CB30FA: GetTickCount.KERNEL32 ref: 02CB3103
Part of subcall function 02CB30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02CB3128

GetCurrentThreadId.KERNEL32 ref: 02CB3929
GetCurrentThreadId.KERNEL32 ref: 02CB3939

Strings

%FROM_EMAIL, xrefs: 02CB3913

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: bb0da020d7e55f6bc7f97696af158d5f6e94b522d1b700588b25ff8678bedce9
Instruction ID: 95702af9a6eb07e399e0318d0a32781a6a2f61d91bbe0e5e4d51b00bed8971ff
Opcode Fuzzy Hash: bb0da020d7e55f6bc7f97696af158d5f6e94b522d1b700588b25ff8678bedce9
Instruction Fuzzy Hash: F2114671D40244EFE722DF19D480A98F3F5FF08716F208A9EE85197280C770AA81DFA1

Function 02CBAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,02CBBD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 02CBABB9
InterlockedIncrement.KERNEL32(02CC3640), ref: 02CBABE1

Strings

%FROM_EMAIL, xrefs: 02CBAB8C

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 3d0ffbc68a5ae6e9c4b83989dde23ea19d1ad553d35f5daa357d3455a2f1847c
Instruction ID: 7a1ff20d764242e712ade3eda8a88c0c229ccb799c3b9915be942742fab1e1a0
Opcode Fuzzy Hash: 3d0ffbc68a5ae6e9c4b83989dde23ea19d1ad553d35f5daa357d3455a2f1847c
Instruction Fuzzy Hash: 65015A319482C4AFEB12CE19D881F967BAABF55254F254899E5D08B202C3B1E684CBA1

Function 02CB26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02CB26C3
inet_ntoa.WS2_32(?), ref: 02CB26E4

Strings

localcfg, xrefs: 02CB26CD, 02CB26D2, 02CB26DE

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 6a8425f32f89414f0342c2597e353538970fc4e6ddd08f114b724ef08ff51ca6
Instruction ID: 51869b7df2d31c606ae5195b5188181d737a0b890b45fd703ea6f02eef0d03f9
Opcode Fuzzy Hash: 6a8425f32f89414f0342c2597e353538970fc4e6ddd08f114b724ef08ff51ca6
Instruction Fuzzy Hash: 52F03732598209BFEF056FB4EC05BEA379DDF05650F144425FD08DA090DB71D950D799

Function 02CBEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02CBEB54,_alldiv,02CBF0B7,80000001,00000000,00989680,00000000,?,?,?,02CBE342,00000000,7508EA50,80000001,00000000), ref: 02CBEAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 02CBEB07

Strings

ntdll.dll, xrefs: 02CBEAED

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 61acc11cfb4ab93c886c0dc386deddd3525b277323e49ca2209beeeefad447c4
Instruction ID: c72c3dd8bc51e7911a1e7a32f54218dd233cb44e799b937ee3df0b2b59b26417
Opcode Fuzzy Hash: 61acc11cfb4ab93c886c0dc386deddd3525b277323e49ca2209beeeefad447c4
Instruction Fuzzy Hash: 5FD0C934A903429B9F135F65AE0AB8576ECBB84B11BA08959E41AD2202E730D424DA08

Function 02CB2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02CB2D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02CB2F01,?,02CB20FF,02CC2000), ref: 02CB2D3A
Part of subcall function 02CB2D21: LoadLibraryA.KERNEL32(?), ref: 02CB2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02CB2F73
HeapFree.KERNEL32(00000000), ref: 02CB2F7A

Memory Dump Source

Source File: 00000011.00000002.3242409275.0000000002CB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2cb0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: cc7e9ff9bcc700a3cabc7c1fad2c582696bc43ab2974f1cd7957661e96daf4f7
Instruction ID: 623bbf3a5ac2cf4d3c14a32f2f0765676122b57390aac8c2762ce1c79edecc34
Opcode Fuzzy Hash: cc7e9ff9bcc700a3cabc7c1fad2c582696bc43ab2974f1cd7957661e96daf4f7
Instruction Fuzzy Hash: 51517D7590029ADFDF029F64D888AFABB79FF05304F1445A9EC96D7210E7329A19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lYWiDKe1In.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\bvvnqaeq.exe

C:\Windows\SysWOW64\djiglggs\bvvnqaeq.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
lYWiDKe1In.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre