Edit tour

Windows Analysis Report
I5vhb7vJPS.exe

Overview

General Information

Sample name:	I5vhb7vJPS.exe renamed because original name is a hash value
Original sample name:	b2de784471ee083a4a7e2d6f3057e00c.exe
Analysis ID:	1457406
MD5:	b2de784471ee083a4a7e2d6f3057e00c
SHA1:	03e5e0fd35a1eba05ddb6d0c4f4a9d8c8d4c67a3
SHA256:	a58c26dd8d015d4e3b081b09c3b21f1cff71e42abe545d90872c2eef003d51c9
Tags:	32exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

I5vhb7vJPS.exe (PID: 2060 cmdline: "C:\Users\user\Desktop\I5vhb7vJPS.exe" MD5: B2DE784471EE083A4A7E2D6F3057E00C)

cmd.exe (PID: 7132 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jjcfhqgg\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7188 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\jjcfhqgg\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7248 cmdline: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7316 cmdline: "C:\Windows\System32\sc.exe" description jjcfhqgg "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7372 cmdline: "C:\Windows\System32\sc.exe" start jjcfhqgg MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7448 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7556 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1028 MD5: C31336C1EFC2CCB44B4326EA793040F2)

wzsddmnn.exe (PID: 7424 cmdline: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d"C:\Users\user\Desktop\I5vhb7vJPS.exe" MD5: 7A52D04B959713B97D2AED6162857A7F)

svchost.exe (PID: 7612 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 584 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7456 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7536 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7620 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7424 -ip 7424 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4b22:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x481a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: I5vhb7vJPS.exe PID: 2060	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: wzsddmnn.exe PID: 7424	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 7612	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.I5vhb7vJPS.exe.20b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.I5vhb7vJPS.exe.20b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.3.wzsddmnn.exe.d90000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.wzsddmnn.exe.d90000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.wzsddmnn.exe.630e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.630e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.wzsddmnn.exe.630e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.wzsddmnn.exe.630e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.630e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.wzsddmnn.exe.dd0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.wzsddmnn.exe.dd0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.dd0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.wzsddmnn.exe.d90000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.wzsddmnn.exe.d90000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.wzsddmnn.exe.d90000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.wzsddmnn.exe.dd0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.wzsddmnn.exe.dd0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.dd0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.wzsddmnn.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.wzsddmnn.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.I5vhb7vJPS.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.I5vhb7vJPS.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.I5vhb7vJPS.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
17.2.svchost.exe.4c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.4c0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.4c0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.wzsddmnn.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.wzsddmnn.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.wzsddmnn.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.I5vhb7vJPS.exe.20d0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.I5vhb7vJPS.exe.20d0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.I5vhb7vJPS.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.I5vhb7vJPS.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.I5vhb7vJPS.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
17.2.svchost.exe.4c0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.4c0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.4c0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d"C:\Users\user\Desktop\I5vhb7vJPS.exe", ParentImage: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, ParentProcessId: 7424, ParentProcessName: wzsddmnn.exe, ProcessCommandLine: svchost.exe, ProcessId: 7612, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\I5vhb7vJPS.exe", ParentImage: C:\Users\user\Desktop\I5vhb7vJPS.exe, ParentProcessId: 2060, ParentProcessName: I5vhb7vJPS.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7248, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.47.54.36, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 7612, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d"C:\Users\user\Desktop\I5vhb7vJPS.exe", ParentImage: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, ParentProcessId: 7424, ParentProcessName: wzsddmnn.exe, ProcessCommandLine: svchost.exe, ProcessId: 7612, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 7612, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jjcfhqgg

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\I5vhb7vJPS.exe", ParentImage: C:\Users\user\Desktop\I5vhb7vJPS.exe, ParentProcessId: 2060, ParentProcessName: I5vhb7vJPS.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7248, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7456, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: I5vhb7vJPS.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wzsddmnn.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wzsddmnn.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: I5vhb7vJPS.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Unpacked PE file: 0.2.I5vhb7vJPS.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Unpacked PE file: 11.2.wzsddmnn.exe.400000.0.unpack

Source: I5vhb7vJPS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\jjcfhqgg

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.76.228.127 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 67.195.228.110 67.195.228.110
Source: Joe Sandbox View	IP Address: 104.47.54.36 104.47.54.36

Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 104.47.54.36:25
Source: global traffic	TCP traffic: 192.168.2.4:60617 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.4:60618 -> 64.233.166.27:25
Source: global traffic	TCP traffic: 192.168.2.4:60621 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60619
Source: unknown	Network traffic detected: HTTP traffic on port 60619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60622
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5vhb7vJPS.exe PID: 2060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wzsddmnn.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7612, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.wzsddmnn.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.wzsddmnn.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.630e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.630e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jjcfhqgg\

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_004CC913	17_2_004CC913

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: String function: 020B27AB appears 35 times
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060

Source: I5vhb7vJPS.exe, 00000000.00000002.1728449668.0000000000432000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesasdf* vs I5vhb7vJPS.exe
Source: I5vhb7vJPS.exe, 00000000.00000002.1728956745.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesasdf* vs I5vhb7vJPS.exe
Source: I5vhb7vJPS.exe, 00000000.00000002.1728956745.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs I5vhb7vJPS.exe
Source: I5vhb7vJPS.exe	Binary or memory string: OriginalFilenamesasdf* vs I5vhb7vJPS.exe

Source: I5vhb7vJPS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.wzsddmnn.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.wzsddmnn.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.630e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.630e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.I5vhb7vJPS.exe.20d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/3@8/5

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00627B50 CreateToolhelp32Snapshot,Module32First,

0_2_00627B50

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_004C9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_004C9A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7536:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7620:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

File created: C:\Users\user\AppData\Local\Temp\wzsddmnn.exe

Jump to behavior

Source: I5vhb7vJPS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

File read: C:\Users\user\Desktop\I5vhb7vJPS.exe

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14750
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_11-14892

Source: unknown	Process created: C:\Users\user\Desktop\I5vhb7vJPS.exe "C:\Users\user\Desktop\I5vhb7vJPS.exe"
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jjcfhqgg\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\jjcfhqgg\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jjcfhqgg "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jjcfhqgg
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d"C:\Users\user\Desktop\I5vhb7vJPS.exe"
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1028
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7424 -ip 7424
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 584
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jjcfhqgg\	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\jjcfhqgg\	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jjcfhqgg "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jjcfhqgg	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1028	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7424 -ip 7424	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 584	Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: I5vhb7vJPS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Unpacked PE file: 0.2.I5vhb7vJPS.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Unpacked PE file: 11.2.wzsddmnn.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Unpacked PE file: 0.2.I5vhb7vJPS.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Unpacked PE file: 11.2.wzsddmnn.exe.400000.0.unpack

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_0062AE38 push 0000002Bh; iretd		0_2_0062AE3E
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_004A5B30 push 0000002Bh; iretd		11_2_004A5B36

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	File created: C:\Users\user\AppData\Local\Temp\wzsddmnn.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jjcfhqgg

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\i5vhb7vjps.exe

Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

17_2_004C199C

Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-15751
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_17-6438
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15185

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_17-6145

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15192
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-15267
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_17-7327

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_17-7447

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_17-6175
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14765
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_11-14907

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7656	Thread sleep count: 32 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7656	Thread sleep time: -32000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000011.00000002.2903167082.0000000002A00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQf-

Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_17-6179
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_17-6437

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_0-16236
Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_17-7671

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_0062742D push dword ptr fs:[00000030h]	0_2_0062742D
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_020B092B mov eax, dword ptr fs:[00000030h]	0_2_020B092B
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_020B0D90 mov eax, dword ptr fs:[00000030h]	0_2_020B0D90
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_004A2125 push dword ptr fs:[00000030h]	11_2_004A2125
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_0063092B mov eax, dword ptr fs:[00000030h]	11_2_0063092B
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_00630D90 mov eax, dword ptr fs:[00000030h]	11_2_00630D90

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_004C9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_004C9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.76.228.127 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4C0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 4C0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4C0000			Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3E5008			Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jjcfhqgg\	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\jjcfhqgg\	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jjcfhqgg "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jjcfhqgg	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1028	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7424 -ip 7424	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 584	Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

0_2_00407809

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5vhb7vJPS.exe PID: 2060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wzsddmnn.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7612, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 11.2.wzsddmnn.exe.630e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.I5vhb7vJPS.exe.20d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.wzsddmnn.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.20b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.wzsddmnn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.I5vhb7vJPS.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: I5vhb7vJPS.exe PID: 2060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wzsddmnn.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7612, type: MEMORYSTR

Source: C:\Users\user\Desktop\I5vhb7vJPS.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_004C88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	17_2_004C88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
I5vhb7vJPS.exe	100%	Avira	HEUR/AGEN.1310445
I5vhb7vJPS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\wzsddmnn.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\wzsddmnn.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	0%	Avira URL Cloud	safe
jotunheim.name:443	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mta6.am0.yahoodns.net	67.195.228.110	true	true	unknown
mxs.mail.ru	217.69.139.150	true	true	unknown
microsoft-com.mail.protection.outlook.com	104.47.54.36	true	true	unknown
vanaheim.cn	62.76.228.127	true	true	unknown
smtp.google.com	64.233.166.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: safe	unknown
jotunheim.name:443	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
64.233.166.27	smtp.google.com	United States	15169	GOOGLEUS	false
62.76.228.127	vanaheim.cn	Russian Federation	201211	DRUGOYTEL-ASRU	true
67.195.228.110	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
104.47.54.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457406
Start date and time:	2024-06-14 17:49:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	I5vhb7vJPS.exe renamed because original name is a hash value
Original Sample Name:	b2de784471ee083a4a7e2d6f3057e00c.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/3@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 62 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.70.246.20, 20.76.201.171, 20.236.44.162, 20.231.239.246
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: I5vhb7vJPS.exe

Simulations

Behavior and APIs

Time	Type	Description
11:50:48	API Interceptor	5x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
217.69.139.150	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
	0bv3c9AqYs.exe	Get hash	malicious	Pushdo	Browse
62.76.228.127	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
67.195.228.110	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB6340-x86.exe	Get hash	malicious	Unknown	Browse
	JgC7A84YOU.exe	Get hash	malicious	Tofsee Xmrig	Browse
104.47.54.36	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.11678.1633.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vanaheim.cn	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	file.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
mta6.am0.yahoodns.net	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.72
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.228.109
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.91
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
microsoft-com.mail.protection.outlook.com	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	file.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.11.0
mxs.mail.ru	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DRUGOYTEL-ASRU	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	http://students.humanconnections.com.au/Y0X.swf?8o542c!cbbbbxm0wqr!c!jtn1s!f40w2!dg!dbk!ck!hrx1b!5hb4!cbbcq4	Get hash	malicious	Unknown	Browse	62.76.228.2
	RSVAU8h96h	Get hash	malicious	Mirai	Browse	185.73.18.199
	LRLZJUXBPk	Get hash	malicious	Mirai	Browse	185.73.18.116
MAILRU-ASMailRuRU	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	5.61.23.11
	x64.nn.elf	Get hash	malicious	Mirai	Browse	128.140.169.91
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	uUyFtCTKDd.elf	Get hash	malicious	Mirai	Browse	94.100.184.243
	https://www.ixxin.cn/go.html?url=https://ok.me/b5SG1?M6bxrJ9vlWS?MtRgHryntBJ	Get hash	malicious	GRQ Scam	Browse	217.20.155.6
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	c40snYcuW6.elf	Get hash	malicious	Mirai	Browse	5.61.23.80
YAHOO-GQ1US	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	98.137.11.164
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
	n6UMcur8v3.elf	Get hash	malicious	Mirai	Browse	98.137.238.181
	zGP5DlrwgZ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.137.103.190
	9g5gIOlb47.elf	Get hash	malicious	Mirai	Browse	98.139.117.88
	https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB	Get hash	malicious	Unknown	Browse	98.136.144.138
	https://t.co/yKnQGIBNmn	Get hash	malicious	HTMLPhisher	Browse	74.6.160.138
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	z8s945rPmZ.exe	Get hash	malicious	SystemBC	Browse	67.195.12.34
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://ms-doc.secure-chamber-fil3-doc3565.com/?Ld6B=D0T	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://amgraphpackaging-my.sharepoint.com/:b:/g/personal/bill_porter_amgraph_com/ERqPRNocNI1EhInqBXiZCNcBcNlJy6x3bcIl0rs7cvc1SQ?e=hkckXP	Get hash	malicious	HTMLPhisher	Browse	52.168.112.67
	c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe	Get hash	malicious	SystemBC	Browse	52.101.194.0
	https://boulderassociates-my.sharepoint.com/:b:/p/jsiedler/EWuN3LkL0-lAvjE8xdj-xWcBGqe_EqpoEsT8zVs-mIcKMQ?e=4%3auM1Jkx&at=9	Get hash	malicious	HTMLPhisher	Browse	52.104.69.55
	http://misprogramaspc.com/itoolab-watsgo	Get hash	malicious	Unknown	Browse	13.107.42.14
	http://www.manchac.com	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://firebasestorage.googleapis.com/v0/b/open-1bebe.appspot.com/o/sci.html?alt=media&token=cd1dbc1a-6097-4fcc-a13d-476f52e5185a	Get hash	malicious	HTMLPhisher	Browse	13.107.253.67
	hlopRb4roR.msi	Get hash	malicious	Unknown	Browse	13.107.21.239
	Odeme_Takvimi_Ocak-2024.xll	Get hash	malicious	Unknown	Browse	13.107.253.43
	Odeme_Takvimi_Ocak-2024.xll	Get hash	malicious	Unknown	Browse	13.107.253.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\wzsddmnn.exe

Download File

Process:	C:\Users\user\Desktop\I5vhb7vJPS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13975552
Entropy (8bit):	4.8240685222091795
Encrypted:	false
SSDEEP:	98304:xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn:
MD5:	7A52D04B959713B97D2AED6162857A7F
SHA1:	C9C66E090A2C11D21E5C6D947464391834B102AB
SHA-256:	4C202424A49B3BEE00F70548DFB7BD5566A35C75D59B1869A2260E73C9469DD3
SHA-512:	9812791EA4968E4EEC504C9CB1928A273C57A2DF2DC1BC271298F497FCB092AEF21B5C6896C257957DF7F66B22DBDC83C9068D5676BB335ADDC470F6F88408A7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WO..6!.6!.6!..@..6!..@..6!..@...6!.N..6!.6 ..6!..@..6!..@..6!..@..6!.Rich.6!.........PE..L....S.c.................t...Z......./............@............................................................................(.... ..(...............................................................@...............H............................text....s.......t.................. ..`.rdata...-...........x..............@..@.data....V.......t..................@....rsrc...(.... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13975552
Entropy (8bit):	4.8240685222091795
Encrypted:	false
SSDEEP:	98304:xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn:
MD5:	7A52D04B959713B97D2AED6162857A7F
SHA1:	C9C66E090A2C11D21E5C6D947464391834B102AB
SHA-256:	4C202424A49B3BEE00F70548DFB7BD5566A35C75D59B1869A2260E73C9469DD3
SHA-512:	9812791EA4968E4EEC504C9CB1928A273C57A2DF2DC1BC271298F497FCB092AEF21B5C6896C257957DF7F66B22DBDC83C9068D5676BB335ADDC470F6F88408A7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WO..6!.6!.6!..@..6!..@..6!..@...6!.N..6!.6 ..6!..@..6!..@..6!..@..6!.Rich.6!.........PE..L....S.c.................t...Z......./............@............................................................................(.... ..(...............................................................@...............H............................text....s.......t.................. ..`.rdata...-...........x..............@..@.data....V.......t..................@....rsrc...(.... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.183458430559476
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	I5vhb7vJPS.exe
File size:	317'440 bytes
MD5:	b2de784471ee083a4a7e2d6f3057e00c
SHA1:	03e5e0fd35a1eba05ddb6d0c4f4a9d8c8d4c67a3
SHA256:	a58c26dd8d015d4e3b081b09c3b21f1cff71e42abe545d90872c2eef003d51c9
SHA512:	5aa37e1305403375b475df3abb5cb60aa6ae4e2f5f07b4d45828c67ef7591e931b7155e135d4898dc982404042dfaa7adb02f9fd12a8336b9cd30955f08125fb
SSDEEP:	3072:iPlmU+ROj7FN7oY9hjFJBqqKjOyTpZHNBmN+tTJfNr+1QbSoymwTTuB:iPX+RAxoYzMF5TpZtBmwG0SdTy
TLSH:	6A64180B92E1BC44E5364B31AF2ED7ECB70DF8918E1AA75A32187E5F14B1172DA63710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........WO..6!..6!..6!..@...6!..@...6!..@...6!..N...6!..6 ..6!..@...6!..@...6!..@...6!.Rich.6!.........PE..L....S.c.................t.

File Icon


Icon Hash:	412545454d4d410d

Static PE Info

General

Entrypoint:	0x402fc0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x63F353F4 [Mon Feb 20 11:05:24 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	324b9e9be8589ec10412a9c657707429

Entrypoint Preview

Instruction
call 00007F11C4E9A00Fh
jmp 00007F11C4E97ABEh
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword ptr [ebp+08h]
push esi
push edi
test edx, edx
je 00007F11C4E97C39h
mov edi, dword ptr [ebp+0Ch]
test edi, edi
jne 00007F11C4E97C45h
call 00007F11C4E97DDEh
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007F11C4E9A20Bh
mov eax, esi
jmp 00007F11C4E97C65h
mov eax, dword ptr [ebp+10h]
test eax, eax
jne 00007F11C4E97C36h
mov byte ptr [edx], al
jmp 00007F11C4E97C14h
mov esi, edx
sub esi, eax
mov cl, byte ptr [eax]
mov byte ptr [esi+eax], cl
inc eax
test cl, cl
je 00007F11C4E97C35h
dec edi
jne 00007F11C4E97C25h
test edi, edi
jne 00007F11C4E97C43h
mov byte ptr [edx], 00000000h
call 00007F11C4E97DA8h
push 00000022h
pop ecx
mov dword ptr [eax], ecx
mov esi, ecx
jmp 00007F11C4E97BF8h
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
cmp ebx, FFFFFFE0h
jnbe 00007F11C4E97CA1h
push esi
push edi
cmp dword ptr [00423330h], 00000000h
jne 00007F11C4E97C4Ah
call 00007F11C4E997FBh
push 0000001Eh
call 00007F11C4E99645h
push 000000FFh
call 00007F11C4E98D29h
pop ecx
pop ecx
test ebx, ebx
je 00007F11C4E97C36h
mov eax, ebx
jmp 00007F11C4E97C35h
xor eax, eax
inc eax
push eax
push 00000000h
push dword ptr [00423330h]
call dword ptr [00409084h]
mov edi, eax
test edi, edi
jne 00007F11C4E97C58h
push 0000000Ch
pop esi
cmp dword ptr [004234D8h], eax
je 00007F11C4E97C3Fh
push ebx
call 00007F11C4E97C6Ch

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb694	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x2bd28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb6bc	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb218	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x73b0	0x7400	711f9ba02bf97f5002064db8d447507d	False	0.6531182650862069	data	6.68377040220723	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2dfe	0x2e00	212ae5b30a801ef9e1a10af96edfb27f	False	0.350288722826087	data	4.960285933311088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x256ec	0x17400	4683dc69cd1ddf9b31d4fd080f3041ec	False	0.8863932291666666	data	7.579863731443322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x32000	0x2bd28	0x2be00	4b896f572ae928951be7a011dc7cbc34	False	0.3762631321225071	data	4.786429420432101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x550c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x55f70	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x56818	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x56db0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x57c58	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x58500	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x58a98	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x58bc8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x58ca0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x59b48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x5a3f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x5a988	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x5b830	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x5c0d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x32df0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Japanese	Japan	0.47547974413646055
RT_ICON	0x33c98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Japanese	Japan	0.5934115523465704
RT_ICON	0x34540	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Japanese	Japan	0.6463133640552995
RT_ICON	0x34c08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Japanese	Japan	0.6856936416184971
RT_ICON	0x35170	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Japanese	Japan	0.37385892116182573
RT_ICON	0x37718	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Japanese	Japan	0.47607879924953095
RT_ICON	0x387c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Japanese	Japan	0.5520491803278689
RT_ICON	0x39148	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Japanese	Japan	0.6329787234042553
RT_ICON	0x39628	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.4112903225806452
RT_ICON	0x39cf0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.16400414937759336
RT_ICON	0x3c298	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.21365248226950354
RT_ICON	0x3c730	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.3670042643923241
RT_ICON	0x3d5d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.44945848375451264
RT_ICON	0x3de80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.45794930875576034
RT_ICON	0x3e548	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.4523121387283237
RT_ICON	0x3eab0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.2697095435684647
RT_ICON	0x41058	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.3072232645403377
RT_ICON	0x42100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.3599290780141844
RT_ICON	0x425d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.56636460554371
RT_ICON	0x43478	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.5451263537906137
RT_ICON	0x43d20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.6127167630057804
RT_ICON	0x44288	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.46390041493775935
RT_ICON	0x46830	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.4896810506566604
RT_ICON	0x478d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Japanese	Japan	0.49385245901639346
RT_ICON	0x48260	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.44769503546099293
RT_ICON	0x48730	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.4141791044776119
RT_ICON	0x495d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.5072202166064982
RT_ICON	0x49e80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5985023041474654
RT_ICON	0x4a548	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.5505780346820809
RT_ICON	0x4aab0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.43734439834024896
RT_ICON	0x4d058	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.45614446529080677
RT_ICON	0x4e100	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Japanese	Japan	0.4680327868852459
RT_ICON	0x4ea88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.5159574468085106
RT_ICON	0x4ef68	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Japanese	Japan	0.4906716417910448
RT_ICON	0x4fe10	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Japanese	Japan	0.47157039711191334
RT_ICON	0x506b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Japanese	Japan	0.44147398843930635
RT_ICON	0x50c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.279149377593361
RT_ICON	0x531c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Japanese	Japan	0.2865853658536585
RT_ICON	0x54270	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Japanese	Japan	0.30245901639344264
RT_ICON	0x54bf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.3421985815602837
RT_STRING	0x5c8d8	0x3b8	data	Japanese	Japan	0.4684873949579832
RT_STRING	0x5cc90	0x60c	data	Japanese	Japan	0.4321705426356589
RT_STRING	0x5d2a0	0x11c	data	Japanese	Japan	0.5633802816901409
RT_STRING	0x5d3c0	0x1b6	data	Japanese	Japan	0.5365296803652968
RT_STRING	0x5d578	0x7ac	data	Japanese	Japan	0.4195519348268839
RT_GROUP_CURSOR	0x56d80	0x30	data			0.9375
RT_GROUP_CURSOR	0x58a68	0x30	data			0.9375
RT_GROUP_CURSOR	0x58c78	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x5a958	0x30	data			0.9375
RT_GROUP_CURSOR	0x5c640	0x30	data			0.9375
RT_GROUP_ICON	0x486c8	0x68	data	Japanese	Japan	0.7211538461538461
RT_GROUP_ICON	0x3c700	0x30	data	Japanese	Japan	1.0
RT_GROUP_ICON	0x395b0	0x76	data	Japanese	Japan	0.6610169491525424
RT_GROUP_ICON	0x42568	0x68	data	Japanese	Japan	0.7115384615384616
RT_GROUP_ICON	0x4eef0	0x76	data	Japanese	Japan	0.6864406779661016
RT_GROUP_ICON	0x55060	0x68	data	Japanese	Japan	0.7115384615384616
RT_VERSION	0x5c670	0x268	MS Windows COFF Motorola 68000 object file			0.5081168831168831

Imports

DLL

Import

KERNEL32.dll

SetComputerNameW, GetTickCount, GetWindowsDirectoryA, GetUserDefaultLangID, TlsSetValue, GlobalAlloc, LoadLibraryW, AssignProcessToJobObject, ReadProcessMemory, lstrcatA, GetACP, IsBadStringPtrA, GetLastError, SetLastError, GetProcAddress, SetComputerNameA, BuildCommDCBW, LoadLibraryA, InterlockedExchangeAdd, GetDiskFreeSpaceA, FoldStringW, FoldStringA, GetModuleFileNameA, FindFirstVolumeMountPointA, LoadLibraryExA, OutputDebugStringA, HeapFree, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, HeapAlloc, HeapCreate, WriteFile, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, Sleep, HeapSize, GetModuleHandleW, ExitProcess, TlsAlloc, TlsGetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, SetUnhandledExceptionFilter, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, UnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, WriteConsoleW, MultiByteToWideChar, SetFilePointer, SetStdHandle, RtlUnwind, GetCPInfo, GetOEMCP, IsValidCodePage, CreateFileW, CloseHandle, GetStringTypeW, LCMapStringW, IsProcessorFeaturePresent

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 14, 2024 17:50:06.074909925 CEST	49732	25	192.168.2.4	104.47.54.36
Jun 14, 2024 17:50:07.082356930 CEST	49732	25	192.168.2.4	104.47.54.36
Jun 14, 2024 17:50:09.082544088 CEST	49732	25	192.168.2.4	104.47.54.36
Jun 14, 2024 17:50:09.220607042 CEST	49733	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:09.220696926 CEST	443	49733	62.76.228.127	192.168.2.4
Jun 14, 2024 17:50:09.221024036 CEST	49733	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:13.082393885 CEST	49732	25	192.168.2.4	104.47.54.36
Jun 14, 2024 17:50:21.098066092 CEST	49732	25	192.168.2.4	104.47.54.36
Jun 14, 2024 17:50:26.085498095 CEST	60617	25	192.168.2.4	67.195.228.110
Jun 14, 2024 17:50:27.082498074 CEST	60617	25	192.168.2.4	67.195.228.110
Jun 14, 2024 17:50:29.098089933 CEST	60617	25	192.168.2.4	67.195.228.110
Jun 14, 2024 17:50:33.098094940 CEST	60617	25	192.168.2.4	67.195.228.110
Jun 14, 2024 17:50:41.113809109 CEST	60617	25	192.168.2.4	67.195.228.110
Jun 14, 2024 17:50:46.123295069 CEST	60618	25	192.168.2.4	64.233.166.27
Jun 14, 2024 17:50:47.113743067 CEST	60618	25	192.168.2.4	64.233.166.27
Jun 14, 2024 17:50:49.113847017 CEST	60618	25	192.168.2.4	64.233.166.27
Jun 14, 2024 17:50:49.207686901 CEST	49733	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:49.207878113 CEST	443	49733	62.76.228.127	192.168.2.4
Jun 14, 2024 17:50:49.207978010 CEST	49733	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:49.317739010 CEST	60619	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:49.317795992 CEST	443	60619	62.76.228.127	192.168.2.4
Jun 14, 2024 17:50:49.317987919 CEST	60619	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:50:53.113790035 CEST	60618	25	192.168.2.4	64.233.166.27
Jun 14, 2024 17:51:01.129556894 CEST	60618	25	192.168.2.4	64.233.166.27
Jun 14, 2024 17:51:06.180938005 CEST	60621	25	192.168.2.4	217.69.139.150
Jun 14, 2024 17:51:07.191838026 CEST	60621	25	192.168.2.4	217.69.139.150
Jun 14, 2024 17:51:09.207463026 CEST	60621	25	192.168.2.4	217.69.139.150
Jun 14, 2024 17:51:13.216495991 CEST	60621	25	192.168.2.4	217.69.139.150
Jun 14, 2024 17:51:21.223325014 CEST	60621	25	192.168.2.4	217.69.139.150
Jun 14, 2024 17:51:29.333148003 CEST	60619	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:51:29.333409071 CEST	443	60619	62.76.228.127	192.168.2.4
Jun 14, 2024 17:51:29.333817005 CEST	60619	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:51:29.443281889 CEST	60622	443	192.168.2.4	62.76.228.127
Jun 14, 2024 17:51:29.443311930 CEST	443	60622	62.76.228.127	192.168.2.4
Jun 14, 2024 17:51:29.443459988 CEST	60622	443	192.168.2.4	62.76.228.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 14, 2024 17:50:06.045389891 CEST	53701	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:06.074537039 CEST	53	53701	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:09.036561966 CEST	54464	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:09.219655037 CEST	53	54464	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:18.544267893 CEST	53	50063	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:26.067717075 CEST	60532	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:26.075263023 CEST	53	60532	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:26.076111078 CEST	64230	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:26.084713936 CEST	53	64230	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:46.099144936 CEST	55986	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:46.110491991 CEST	53	55986	1.1.1.1	192.168.2.4
Jun 14, 2024 17:50:46.111116886 CEST	53795	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:50:46.121073008 CEST	53	53795	1.1.1.1	192.168.2.4
Jun 14, 2024 17:51:06.114952087 CEST	62635	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:51:06.123189926 CEST	53	62635	1.1.1.1	192.168.2.4
Jun 14, 2024 17:51:06.124459982 CEST	51997	53	192.168.2.4	1.1.1.1
Jun 14, 2024 17:51:06.179848909 CEST	53	51997	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 14, 2024 17:50:06.045389891 CEST	192.168.2.4	1.1.1.1	0x62f4	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:09.036561966 CEST	192.168.2.4	1.1.1.1	0xef2e	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.067717075 CEST	192.168.2.4	1.1.1.1	0x10ab	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:26.076111078 CEST	192.168.2.4	1.1.1.1	0xb125	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.099144936 CEST	192.168.2.4	1.1.1.1	0x4415	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:46.111116886 CEST	192.168.2.4	1.1.1.1	0x6888	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:51:06.114952087 CEST	192.168.2.4	1.1.1.1	0xdefc	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:51:06.124459982 CEST	192.168.2.4	1.1.1.1	0xcdb5	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 14, 2024 17:50:06.074537039 CEST	1.1.1.1	192.168.2.4	0x62f4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:06.074537039 CEST	1.1.1.1	192.168.2.4	0x62f4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:09.219655037 CEST	1.1.1.1	192.168.2.4	0xef2e	No error (0)	vanaheim.cn	62.76.228.127	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.075263023 CEST	1.1.1.1	192.168.2.4	0x10ab	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:26.075263023 CEST	1.1.1.1	192.168.2.4	0x10ab	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:26.075263023 CEST	1.1.1.1	192.168.2.4	0x10ab	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:26.084713936 CEST	1.1.1.1	192.168.2.4	0xb125	No error (0)	mta6.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.110491991 CEST	1.1.1.1	192.168.2.4	0x4415	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:50:46.121073008 CEST	1.1.1.1	192.168.2.4	0x6888	No error (0)	smtp.google.com	64.233.166.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.121073008 CEST	1.1.1.1	192.168.2.4	0x6888	No error (0)	smtp.google.com	74.125.206.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.121073008 CEST	1.1.1.1	192.168.2.4	0x6888	No error (0)	smtp.google.com	74.125.206.26	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.121073008 CEST	1.1.1.1	192.168.2.4	0x6888	No error (0)	smtp.google.com	64.233.167.27	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:50:46.121073008 CEST	1.1.1.1	192.168.2.4	0x6888	No error (0)	smtp.google.com	64.233.167.26	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:51:06.123189926 CEST	1.1.1.1	192.168.2.4	0xdefc	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Jun 14, 2024 17:51:06.179848909 CEST	1.1.1.1	192.168.2.4	0xcdb5	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Jun 14, 2024 17:51:06.179848909 CEST	1.1.1.1	192.168.2.4	0xcdb5	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:49:55
Start date:	14/06/2024
Path:	C:\Users\user\Desktop\I5vhb7vJPS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\I5vhb7vJPS.exe"
Imagebase:	0x400000
File size:	317'440 bytes
MD5 hash:	B2DE784471EE083A4A7E2D6F3057E00C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1689229491.00000000020D0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:49:59
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jjcfhqgg\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:49:59
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:49:59
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\jjcfhqgg\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:49:59
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:50:00
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create jjcfhqgg binPath= "C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d\"C:\Users\user\Desktop\I5vhb7vJPS.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xa30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:50:00
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:50:01
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description jjcfhqgg "wifi internet conection"
Imagebase:	0xa30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:50:01
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:50:01
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start jjcfhqgg
Imagebase:	0xa30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:50:01
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:50:01
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe /d"C:\Users\user\Desktop\I5vhb7vJPS.exe"
Imagebase:	0x400000
File size:	13'975'552 bytes
MD5 hash:	7A52D04B959713B97D2AED6162857A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1756650523.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1754871214.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:50:02
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:50:02
Start date:	14/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:50:02
Start date:	14/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:50:02
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2060 -ip 2060
Imagebase:	0xa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:50:02
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1028
Imagebase:	0xa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:50:05
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x9a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	11:50:05
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7424 -ip 7424
Imagebase:	0xa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:50:05
Start date:	14/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 584
Imagebase:	0xa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	25.6%
Total number of Nodes:	1550
Total number of Limit Nodes:	17

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 798stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?,00000020), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
", xrefs: 00409EDB
\, xrefs: 00409D0C
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 4d376ad398af10e8180197a370fab4305cdb7a8350a95e6006a40bc34d3ada67
Instruction ID: c54dd164401bc8252f7c7d364e59892cce9d7843782f7eb75857c238c925ac93
Opcode Fuzzy Hash: 4d376ad398af10e8180197a370fab4305cdb7a8350a95e6006a40bc34d3ada67
Instruction Fuzzy Hash: 815290B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 22ebba4a15f844ca6926cd38191801fef154a6796d3e5a6cc06fe4d794d23856
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: 22ebba4a15f844ca6926cd38191801fef154a6796d3e5a6cc06fe4d794d23856
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00627B50 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00627B78
Module32First.KERNEL32(00000000,00000224), ref: 00627B98

Memory Dump Source

Source File: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_623000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 673e9bfefa8ebc8bfab8f579407970521f9837e0d9e6c608ff7dbb1850a4a359
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DFF0F632500B21AFD7203FF4B88CFAE72E9AF59326F100168F642911C0CB70EC454E61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 016757daa93d1c8f4fdb8ed6cb81e37ee7fb74fee72fced1de4250a91a8c3a9c
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: 016757daa93d1c8f4fdb8ed6cb81e37ee7fb74fee72fced1de4250a91a8c3a9c
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 2df205727842959c67d89485333c37da782172426ac12f7c67d6d65fc9424ce3
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 2df205727842959c67d89485333c37da782172426ac12f7c67d6d65fc9424ce3
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 548ddad5ef42cfce8c7bacff6a3676c54bc4849cd622c264de59799d3391f747
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 548ddad5ef42cfce8c7bacff6a3676c54bc4849cd622c264de59799d3391f747
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: b1a785068fcebdbf7fbaccced5a56eae94fb2a5cdca60ee24118808f1867984c
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: b1a785068fcebdbf7fbaccced5a56eae94fb2a5cdca60ee24118808f1867984c
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 020B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 020B024D

Strings

kernel32.dll, xrefs: 020B008F, 020B0095
cess, xrefs: 020B018D

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 14817da49ff3392f219a4229ff7d25448ff8ef163c1352c92a335c57ab03c33e
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B8526974A01229DFDBA5CF68C984BADBBB1BF09304F1480D9E54DAB351DB30AA85DF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e8dec48c999e38d9a1383b34990487ed0824902fe415a726a9595d522d2b8c62
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e8dec48c999e38d9a1383b34990487ed0824902fe415a726a9595d522d2b8c62
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: b5ba1f4869b893782c1a8b3f9d638dedecc2304624039232ebf8de47d5d34da1
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: b5ba1f4869b893782c1a8b3f9d638dedecc2304624039232ebf8de47d5d34da1
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 020B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,020B0223,?,?), ref: 020B0E19
SetErrorMode.KERNELBASE(00000000,?,?,020B0223,?,?), ref: 020B0E1E

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c2860f47db282722f4f6209d79134e175963663ed1f9cd71128f4e39bb3dd98e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 53D0123514522877D7512A94DC09BCE7B5CDF05B66F008011FB0DD9080C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: bdb1d1e0272e0a02f4fd0db7a1ece7ab80c25a3e7f07441334a3d300ce80d24d
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: bdb1d1e0272e0a02f4fd0db7a1ece7ab80c25a3e7f07441334a3d300ce80d24d
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 0062780F Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00627860

Memory Dump Source

Source File: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_623000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 41abd7fdae48b6a7d9c1cf1e03571e5e530f07763bb427ef771a44a3f6bb4b75
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CA113C79A00208EFDB01DF98C985E99BFF5AF08351F0580A4F9489B362D375EA50DF90

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1394filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080,.dat), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002,.dat), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,.dat,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

@, xrefs: 0040D754
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
.sys, xrefs: 0040D0CC
drivers\, xrefs: 0040D067
wtm_r, xrefs: 0040C97F
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
flags_upd, xrefs: 0040CE4A
\, xrefs: 0040D39D
\, xrefs: 0040D3A7
local_time, xrefs: 0040CACD
4, xrefs: 0040D9F7
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
srv_time, xrefs: 0040CABB
wtm_w, xrefs: 0040C96C
wtm_c, xrefs: 0040C956
lid_file_upd, xrefs: 0040CE6A
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 3d819cb602cae3537d3f4aaffe5be6d4d62e57ac01cca65cfd5db845ca7bec14
Instruction ID: 7de2b6e3916d61af54a21f8e373482f72987fa921bce225ad61aacfc468b7174
Opcode Fuzzy Hash: 3d819cb602cae3537d3f4aaffe5be6d4d62e57ac01cca65cfd5db845ca7bec14
Instruction Fuzzy Hash: 73B2C471D00209BBEB209FA4DD85FEA7BB9AB08304F14457BF505B22D1D7789A89CB5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtQueryInformationToken, xrefs: 00401262
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
NtOpenProcessToken, xrefs: 004011D4
NtFilterToken, xrefs: 0040122B
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135
RtlSetLastWin32Error, xrefs: 004010D6
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlFreeSid, xrefs: 00401116
NtDuplicateToken, xrefs: 004011F3
NtTerminateProcess, xrefs: 004010F6
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
RtlNtStatusToDosError, xrefs: 00401194

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Feb, xrefs: 0040B25D
Wed, xrefs: 0040B23A
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Mon, xrefs: 0040B22C
Thu, xrefs: 0040B241
Jan, xrefs: 0040B256
Jul, xrefs: 0040B280
Sun, xrefs: 0040B225
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Jun, xrefs: 0040B279
May, xrefs: 0040B272
Mar, xrefs: 0040B264
Tue, xrefs: 0040B233
Oct, xrefs: 0040B295

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00401316
PDu, xrefs: 0040139A
@, xrefs: 00401380
, xrefs: 00401462
<, xrefs: 00401378
uac, xrefs: 00401628
useless, xrefs: 0040161E
D, xrefs: 004015C6
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
work_srv, xrefs: 00401E5E
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: bd1a51c2e9407ac430f6576f859c19e3b22172b3d394597aff4f9cfca0298820
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: bd1a51c2e9407ac430f6576f859c19e3b22172b3d394597aff4f9cfca0298820
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: c16d4a3b1f15c080ebf39b77e6f88fb021d923f107e4966bb67ea8295942f7c8
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: c16d4a3b1f15c080ebf39b77e6f88fb021d923f107e4966bb67ea8295942f7c8
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 0f22fe24dbf077d2b442127c41be14a4979ccbdb3e2203d8393d0dd42a6504e5
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: 0f22fe24dbf077d2b442127c41be14a4979ccbdb3e2203d8393d0dd42a6504e5
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: d0e948cacbc09e720e3321fbcf961fef4977f08be961d70e0acc64f9b42743bb
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: d0e948cacbc09e720e3321fbcf961fef4977f08be961d70e0acc64f9b42743bb
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 020B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 020B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 020B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 020B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 020B6652

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 662921b5bf1401847fbe026ce65465b4f6b718c10bf5159dd3a956fd5314c55c
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: B7116D71600218BFDB229F75DC09FDB3BACEF057A5F004024FA09A7250D7B2DD109AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 3c26a2e63fe1e44e7a0b6f258d651225f22a146f3c30eeb6549516378f5f9d63
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 3c26a2e63fe1e44e7a0b6f258d651225f22a146f3c30eeb6549516378f5f9d63
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 1ec4011c045f949cfec2697498cac72ed0385a77bd95f77c300cb36665fb2fc4
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 1ec4011c045f949cfec2697498cac72ed0385a77bd95f77c300cb36665fb2fc4
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 020B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 020B095F
GetProcAddress., xrefs: 020B09DC, 020B09DF, 020B09E4
l, xrefs: 020B0966

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2c8b122756e7d1c76dbf3307e28635d16f169baddcd9f84f6343000e4a12ced9
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D23149B6900709DFDB21CF99C880AEEBBF6FF48324F14415AD441A7250D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 0062742D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728900989.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_623000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 74caa411b88500afa507b792b79d91b4f03aa53bd90ed31cb016c47221ad2e03
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 99117C72344510AFD754EE55EC91EA677EAEB88320B298069ED08CB312E675EC02CB60

Function 020B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: ae801a88314c073f9ce041e53d5c6a4f1ccaa872c9aa568154bc63fafd5e974a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0201A276A107048FDF33CF24C805BEB33E6FF86216F4545B5D91A97281E774A9418B90

Function 020B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 020B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 020B9FE1
lstrcat.KERNEL32(?,?), ref: 020B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 020BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 020BA054
DeleteFileA.KERNEL32(?), ref: 020BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 020BA0D6
lstrcpy.KERNEL32 ref: 020BA12F
lstrlen.KERNEL32(00000022), ref: 020BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 020B9F13

Part of subcall function 020B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 020B7081

Part of subcall function 020B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ddwzbkaa,020B7043), ref: 020B6F4E
Part of subcall function 020B6F30: GetProcAddress.KERNEL32(00000000), ref: 020B6F55
Part of subcall function 020B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 020B6F7B
Part of subcall function 020B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 020B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 020BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 020BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 020BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 020BA21B
GetDriveTypeA.KERNEL32(?), ref: 020BA265
lstrcat.KERNEL32(?,00000000), ref: 020BA29F
lstrcat.KERNEL32(?,00410A34), ref: 020BA2C5
lstrcat.KERNEL32(?,00000022), ref: 020BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 020BA2F4
wsprintfA.USER32 ref: 020BA31D
lstrcat.KERNEL32(?,00000000), ref: 020BA345
lstrcat.KERNEL32(?,?), ref: 020BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 020BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 020BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 020BA1D1

Part of subcall function 020B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 020B999D
Part of subcall function 020B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 020B99BD
Part of subcall function 020B9966: RegCloseKey.ADVAPI32(?), ref: 020B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 020BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 020BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 020BA41D

Strings

", xrefs: 020BA142
\, xrefs: 020B9F73
D, xrefs: 020BA1F5
", xrefs: 020BA3F0
P, xrefs: 020BA011
", xrefs: 020BA2DF

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: a83e2a8f72b5503957182c00e3a75de5f1d1c8f4338ab88a280c260145a37514
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 4CF131B1D4035DAFDB62DBA08C88FEE7BBCAF08704F0484A6F605E2151E77586849F65

Function 020B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 020B7D21
GetUserNameA.ADVAPI32(?,?), ref: 020B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 020B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 020B7DC0
EqualSid.ADVAPI32(?,?), ref: 020B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 020B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 020B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 020B7E12
LocalFree.KERNEL32(00000000), ref: 020B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 020B7E35

Strings

PromptOnSecureDesktop, xrefs: 020B7FA0
D, xrefs: 020B7D73

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 8e68325ffa114e7c37aff0fcf60c8992f8bdebed37e9d8520a14a4b9ed056e58
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: E8A16C72900219AFDB628FA0DC88FEEBBBDFF48344F048169F515E6160D7758A84DB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
%d=%p, xrefs: 004066F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
plgs:, xrefs: 004066AA
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 9fa8e0b94cba88ccf9c39099ec117cabac316901c6146e9ce34772f6ef20867e
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: 9fa8e0b94cba88ccf9c39099ec117cabac316901c6146e9ce34772f6ef20867e
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
localcfg, xrefs: 0040AB0B
mail from:<%s>, xrefs: 0040A848
quit, xrefs: 0040A86C
rcpt to:<%s>, xrefs: 0040A855
ehlo %s, xrefs: 0040A7F5
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Incorrect respons, xrefs: 0040AB39
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
., xrefs: 0040A8CA
helo %s, xrefs: 0040A803
Too small respons, xrefs: 0040A9C9
ESMTP, xrefs: 0040AA38

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: c2b0cafdd9967373d9d9f1cb15ea6c3679760664ce6b838b3656b1082fd95473
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: c2b0cafdd9967373d9d9f1cb15ea6c3679760664ce6b838b3656b1082fd95473
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 020B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 020B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020B7ACD
GetLengthSid.ADVAPI32(?), ref: 020B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 020B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 020B7B1F
EqualSid.ADVAPI32(?,?), ref: 020B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 020B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 020B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 020B7B77
LocalFree.KERNEL32(00000000), ref: 020B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 020B7B9A
GetAce.ADVAPI32(?,?,?), ref: 020B7BCA
EqualSid.ADVAPI32(?,?), ref: 020B7BF1
DeleteAce.ADVAPI32(?,?), ref: 020B7C0A
EqualSid.ADVAPI32(?,?), ref: 020B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 020B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 020B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 020B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 020B7CE0
LocalFree.KERNEL32(00000000), ref: 020B7CEE

Strings

D, xrefs: 020B7AC3

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: b2c797bf42a13e2057e0704ae4e02491cae11804d492396491a07781cca4b0da
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 3F814C72900219AFDB22CFA4DD84FEEBBB8AF48305F04806EE505E6160D7759A45DF64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: a6af351dc60d213a9e30d467bee2029ed5c5b8402c9b4adaa502445c168a30de
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: a6af351dc60d213a9e30d467bee2029ed5c5b8402c9b4adaa502445c168a30de
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 020B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 020B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 020B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 020B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 020B86B1

Strings

PromptOnSecureDesktop, xrefs: 020B85B6, 020B8645, 020B86BD, 020B8708, 020B87C5, 020B8812, 020B88E9, 020B8905
", xrefs: 020B896C

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 430bf462bc1897731a6494b2fa0bb481d0a9544d765b6ba6ef61e3b89e58ff1a
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 58C18271940309BFEF639BA4DD84EEE7BBDEF08304F148065F504E2060E7718A94AB65

Function 020B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 020B1601
lstrlenW.KERNEL32(-00000003), ref: 020B17D8

Strings

@, xrefs: 020B15E7
<, xrefs: 020B15DF
, xrefs: 020B16C9
D, xrefs: 020B182D

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 39340a4aff4f5a4142df9285fd28095db2b120a8dfde31878d63ecd538f7e7c5
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: BAF16BB15083819FD722CF64C898BEAF7E5FF89304F00892DF59A972A0D7B49944CB56

Function 020B7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 020B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 020B778F
___ascii_stricmp.LIBCMT ref: 020B78B4
RegCloseKey.ADVAPI32(?), ref: 020B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 020B796D
RegCloseKey.ADVAPI32(?), ref: 020B797E
RegCloseKey.ADVAPI32(?), ref: 020B79AC
RegCloseKey.ADVAPI32(?), ref: 020B7A56

Part of subcall function 020BF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,020B772A,?), ref: 020BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 020B79F6
RegCloseKey.ADVAPI32(?), ref: 020B7A4D

Strings

PromptOnSecureDesktop, xrefs: 020B76C5, 020B76CA, 020B76E5, 020B7782, 020B77E6, 020B7862, 020B787B, 020B79C2
", xrefs: 020B7800

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: a9320e0d86e28fe19b14acad2ee09205d3ff45ade1e14a05373a13796a9e4622
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 72C15472900309AFDB739BA4DC45FEEBBB9EF89710F1440A5E504E7160EB719A84DB60

Function 020B2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 020B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 020B2D07
htons.WS2_32(00000000), ref: 020B2D42
select.WS2_32 ref: 020B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 020B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 020B2E62

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: c2dc4a98cd34abb095b38a8ef7d70925226cd8793e95fde724699a3f0261af3c
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: C961CE71504305AFC332AF65DC08BEBBBE8EF48745F004829FD9497250D7B59880EBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: e4e7b347f81ef414ffae5a6dba2503777c8a9ab283212ed9991d401180a6d3c8
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: e4e7b347f81ef414ffae5a6dba2503777c8a9ab283212ed9991d401180a6d3c8
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 99710eefac5b10cb2603ebf4cc5b3122d70b499804368040b16c6ad90511ad8a
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: 99710eefac5b10cb2603ebf4cc5b3122d70b499804368040b16c6ad90511ad8a
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 020B958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 020B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 020B95DC
wsprintfA.USER32 ref: 020B9635
wsprintfA.USER32 ref: 020B9673
wsprintfA.USER32 ref: 020B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 020B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 020B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 020B97D8

Strings

PromptOnSecureDesktop, xrefs: 020B9604, 020B9624, 020B9662, 020B9683, 020B96B6, 020B96DF, 020B9701, 020B9734, 020B9780, 020B97B7

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 08c84401884688bfddd362d642cd0314a891c57d3cc28d23a2e218760a1c9653
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: F8A149B294034CAFEB22DFA0CC85FDE3BADAF08745F104026FA15A6151E7B59584DFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 9552de4cbf515d2b6d47e6dea1da8c2fc5587847f94a27b71e070b1f180ebfee
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 9552de4cbf515d2b6d47e6dea1da8c2fc5587847f94a27b71e070b1f180ebfee
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%M5DATE, xrefs: 0040B50F
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 4d94c23129a6a95dc8b502b505784d49c9536e162242480fe8a8ec954b8a9c2e
Instruction ID: 1184364059730f832c26daebfda2be78d1cd239b5bb8d2ab2a191843992ce0bd
Opcode Fuzzy Hash: 4d94c23129a6a95dc8b502b505784d49c9536e162242480fe8a8ec954b8a9c2e
Instruction Fuzzy Hash: 1E51E2706043465ED728EB25EF49B9A3BD4BB04318F10457FE605E62E2DBFC9898CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: c383e088c647de8533948b28d14b88c3b4e202cf7a7734b8022f5977264c5b02
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: c383e088c647de8533948b28d14b88c3b4e202cf7a7734b8022f5977264c5b02
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 22cde20289bbd58cf4c87b835a79ec9fa87a49d804031adc8a6c655dfaebea53
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: 22cde20289bbd58cf4c87b835a79ec9fa87a49d804031adc8a6c655dfaebea53
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 020B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 020B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 020B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 020B3095
RtlAllocateHeap.NTDLL(00000000), ref: 020B30B6
htons.WS2_32(00000035), ref: 020B30EF
inet_addr.WS2_32(?), ref: 020B30FA
gethostbyname.WS2_32(?), ref: 020B310D
HeapFree.KERNEL32(00000000), ref: 020B314D

Strings

iphlpapi.dll, xrefs: 020B3062, 020B3067, 020B3077

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b65c8f3981448c4a7cd2408d9c22e4f56a5a0134cc61b324c6210c0da88d354a
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: D031C731A00306BBDB639BB89C48BEE77FCEF04364F2445A5E518E3290DB74D9419B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 020B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 020B67C3
htonl.WS2_32(?), ref: 020B67DF
htonl.WS2_32(?), ref: 020B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 020B68F1
ExitProcess.KERNEL32 ref: 020B69BC

Strings

localcfg, xrefs: 020B6994
except_info, xrefs: 020B698F

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 7e9a758e40b918786803386518786f5ade211852a9568743d75c8a9119fb9c5e
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 87616D72A40308AFDB619FA4DC45FEA77E9FF08300F148066FA6DD2161EB7599909F14

Function 020BF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(020BCC84), ref: 020BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 020BF5CE
closesocket.WS2_32(00000000), ref: 020BF5DC

Strings

time_cfg, xrefs: 020BF58A

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 0b33739a1560d10e028c5fe28013605ce0f1c23ebdcb965515021f3b8ed42f9c
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 77318071900219ABDB22DFB5DC88DEE7BFCEF48350F104566F905D3150E7708A819BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 45945144c7b3a0dc554c0e43740ff6cc9c440821671827daef62f6fd9ca141c1
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: 45945144c7b3a0dc554c0e43740ff6cc9c440821671827daef62f6fd9ca141c1
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 020B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 020B2FA1
LoadLibraryA.KERNEL32(?), ref: 020B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 020B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 020B3000
RtlAllocateHeap.NTDLL(00000000), ref: 020B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 020B3032

Strings

dnsapi.dll, xrefs: 020B2F90

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 05a771e34119f56bd418067c1b2b316e7b0a04035cf408f7351097cd6d91eb45
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: A8216271D0172ABBCB339B55DC48AEEBBB8EF08B50F114461F905E7140D7B49A819BD4

Function 020B6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ddwzbkaa,020B7043), ref: 020B6F4E
GetProcAddress.KERNEL32(00000000), ref: 020B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 020B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 020B6F92

Strings

PromptOnSecureDesktop, xrefs: 020B6F9D, 020B6FBF, 020B6FCF, 020B6FE5, 020B6FF5
C:\Windows\SysWOW64\, xrefs: 020B6F30, 020B6F38, 020B6F65, 020B6F6C, 020B6F7A, 020B6F85, 020B6F91, 020B6FA9, 020B6FC6, 020B6FEC
\\.\pipe\ddwzbkaa, xrefs: 020B6F37

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\ddwzbkaa
API String ID: 1082366364-2378185361
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: c23889384eba206123d0151347149b468da05d0e08f4bbf45e7f4045b1ccc4d3
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: FF2101227403457AF77353359C8CFFB2E8C8F52724F1880A6F904E64A1DBDA84D692AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: bf6cadca1482983015e6f85411285f51ea61ea868c04ee3d6e5a036a4d77e9af
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: bf6cadca1482983015e6f85411285f51ea61ea868c04ee3d6e5a036a4d77e9af
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 020B92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 020B92E2
wsprintfA.USER32 ref: 020B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 020B9375
lstrlen.KERNEL32(?,?,00000000), ref: 020B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 020B9394
CloseHandle.KERNEL32(00000000), ref: 020B939B

Strings

PromptOnSecureDesktop, xrefs: 020B932B, 020B9343, 020B935E

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 35c718ada15e68abf739d78001ff3d72bab222af73c65ec3961b68da927d37f2
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: BF1184B17402147BE7316B31EC0DFEF3A6EDFC9B10F00C065BB09E5091EAB44A419A64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: eeac8930079615ecde9ddd9b6b90ae0a2380363d55059ccf95723b33c5a67a0b
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: eeac8930079615ecde9ddd9b6b90ae0a2380363d55059ccf95723b33c5a67a0b
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 020B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 020B9A18
GetThreadContext.KERNEL32(?,?), ref: 020B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 020B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 020B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 020B9AB5
ResumeThread.KERNEL32(?), ref: 020B9AC2

Strings

D, xrefs: 020B9A10

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 5287277037d973d1866bb15bb31516dde5e4ce6657702f0ece33efd24df7609c
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: CE213D7190121DBBDB629BA1DC09EEF7BBCEF05750F404061BA19E1050E7758644DFA4

Function 020B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 020B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 020B1C26
GetProcessHeap.KERNEL32 ref: 020B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 020B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 020B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 020B1D02
FreeLibrary.KERNEL32(?), ref: 020B1D0B

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 195af248adcd451ac020faea8f9895ce3d98a6deee8501eec0e64bf94c16fc92
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 07315E31E00209BFCB629FA4DC988EEFBB9EF45305F24447AE509E2110D7B54E80EB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: 408187160a9fd672143b2fb6dc480bda50dca4705688b53d13eec5f5d618ee99
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 408187160a9fd672143b2fb6dc480bda50dca4705688b53d13eec5f5d618ee99
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: bcf9f26feddd2ed5ed551e83e2f4d069af3bfaacc5c7330f22f0f7afc01b2182
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: bcf9f26feddd2ed5ed551e83e2f4d069af3bfaacc5c7330f22f0f7afc01b2182
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 020B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 020B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 020B6D22
GetLastError.KERNEL32 ref: 020B6DA7
CloseHandle.KERNEL32(?), ref: 020B6DB5
GetLastError.KERNEL32 ref: 020B6DD6
DeleteFileA.KERNEL32(?), ref: 020B6DE7
GetLastError.KERNEL32 ref: 020B6DFD

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 328727202ecef840faef5d3cced1538218e9f8e7becfbff9fdb1fce00649d5bd
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2331F076D00249BFCB22DFA4DD48ADE7FBDEF48300F148066E211E3211D7728A85AB61

Function 020B93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 020B93CD
CharToOemA.USER32(?,?), ref: 020B93DB
wsprintfA.USER32 ref: 020B9410

Part of subcall function 020B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 020B92E2
Part of subcall function 020B92CB: wsprintfA.USER32 ref: 020B9350
Part of subcall function 020B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 020B9375
Part of subcall function 020B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 020B9389
Part of subcall function 020B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 020B9394
Part of subcall function 020B92CB: CloseHandle.KERNEL32(00000000), ref: 020B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 020B9448

Strings

PromptOnSecureDesktop, xrefs: 020B93FA, 020B93FF, 020B941C

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 86a7609f3b6bfbfbdeb51b4ead42456fa0c3bdf319853f87e3b382425e57b17e
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: EE014CF69402187BDB21A7619D89EDF3A7CDB95701F0040A2BB49E2080EAB496C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 020BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 020BAAE5

Strings

localcfg, xrefs: 020BAD72
, xrefs: 020BABB3

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: b9ddbd9b3b962d305894abf2fda2b2cb23b294fde88b712bb4d8ab119be387ba
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 3B712971B00308BADF738B58DC85FEE37A9AF00719F244427F905A7091DF729984AB69

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: b12b09febf6a93b5a857205a9020b291ac36bae7336f41d82ae420c8a7da9417
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: b12b09febf6a93b5a857205a9020b291ac36bae7336f41d82ae420c8a7da9417
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 020BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 020BDF6C: GetCurrentThreadId.KERNEL32 ref: 020BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 020BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,020B6128), ref: 020BE950
lstrcmp.KERNEL32(?,00000008), ref: 020BE989

Strings

A, xrefs: 020BE960, 020BE965
A, xrefs: 020BE8C6, 020BE8CD, 020BE936, 020BE998
A, xrefs: 020BE9A0

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: b70b69cb623f2b8472db7c686d778147b4f4bb76f96dc968348e039985ebf78a
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 67319E31A047059BDFB38F24C884BEA7BE4EF09725F80892AE55687551D374E888EB81

Function 020B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 020B6E19

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 8737b3c9c1ce5211dc5fd96e1ac55da6aaea6382587a2c534dd958b6d1f73533
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 1F214D7A104219BFDB229B60EC48EDF3FADEF49265B108425F512D1091EB71DA40AB74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 020BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 020BC6B4
InterlockedIncrement.KERNEL32(020BC74B), ref: 020BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,020BC747), ref: 020BC728
CloseHandle.KERNEL32(00000000,?,020BC747,00413588,020B8A77), ref: 020BC733

Strings

localcfg, xrefs: 020BC544

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: b770d18bb786006355a93342d3fa015839e3018e4d97ebc0bc63ccc5d569265c
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 485139B1A01B418FE7768F29C99466ABBE9FF48304B50593FE18BC7A90D774E840DB14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: cbafa232a6e94f8975ef8f9c1c9f1bb8b2ba5715a16b1a9a54536c77f0dcfabb
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: cbafa232a6e94f8975ef8f9c1c9f1bb8b2ba5715a16b1a9a54536c77f0dcfabb
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 020BE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,020BE50A,00000000,00000000,00000000,00020106,00000000,020BE50A,00000000,000000E4), ref: 020BE319
RegSetValueExA.ADVAPI32(020BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020BE38E
RegDeleteValueA.ADVAPI32(020BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020BE3BF
RegCloseKey.ADVAPI32(020BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,020BE50A), ref: 020BE3C8

Strings

PromptOnSecureDesktop, xrefs: 020BE33A

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: d7e3380ca434f22873d5833936da4f2bcedc7fc205c087cf0f8d751abd7da75e
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 81212F71A0021DBBDF229FA5EC89EDE7FB9EF08B50F048061F904E6150E7718A54EB90

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 020B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 020B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 020B7228
LocalFree.KERNEL32(?,?,?), ref: 020B7286
wsprintfA.USER32 ref: 020B729D

Strings

|, xrefs: 020B721A

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 002e77e2f083015ba059fd21cb8ae90aa74d41291cb2a8d655d3ab818ef177e5
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: D9313A72900209BFCB12DFA8DC48BDA7BACEF04314F148066F859DB250EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 020BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 020BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 020BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 020BB548
GetTimeZoneInformation.KERNEL32(?), ref: 020BB590
wsprintfA.USER32 ref: 020BB61E

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 9efc873904c55ff832a2e8ee475afec9cefdcbe247178639d8fdaf3cdc0238fa
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: BE5120B1D0021CABCF65CFD5D8885EEBBB9FF48304F10812AE501A6150E7B84AC9DF98

Function 020B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 020B6303
LoadLibraryA.KERNEL32(?), ref: 020B632A
GetProcAddress.KERNEL32(00000000,?), ref: 020B63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 020B6405

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 81b1d130fd931b900514c89300d82a483ab7186e1bb1a1f3c4e411add15b7c8a
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 08415C71A00605ABDB66CF58C884BEDB7F8FF04758F188179E925E7290D772E980EB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9330360b6e1371249270e3654020af71fef978c9da79cf6a334d0c8045d78e73
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 9330360b6e1371249270e3654020af71fef978c9da79cf6a334d0c8045d78e73
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 0f63d472f6005489d6367e153140da01beedcd43e8f3e57f886e240d56cbd5fe
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 0f63d472f6005489d6367e153140da01beedcd43e8f3e57f886e240d56cbd5fe
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 8e6a9532d72d51de89e2fd9f75b6ba5ac83ae2ff66b6af1cfb9e75e8d3b17b2d
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 8e6a9532d72d51de89e2fd9f75b6ba5ac83ae2ff66b6af1cfb9e75e8d3b17b2d
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: b9568b5d259a03ff5e7acc11fe935b2567c3f076d90e58e3ea0b9b9781d75a7f
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: b9568b5d259a03ff5e7acc11fe935b2567c3f076d90e58e3ea0b9b9781d75a7f
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 020BE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 020BDF6C: GetCurrentThreadId.KERNEL32 ref: 020BDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,020BA6AC), ref: 020BE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,020BA6AC), ref: 020BE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,020BA6AC), ref: 020BE819

Strings

PromptOnSecureDesktop, xrefs: 020BE840, 020BE845, 020BE87C, 020BE89B

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 67537bedbd30e0e8633291af622f4aa11ab367e1a8d006700f0deeacef5767b0
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: C32105B1A403007AE6337735AC09FEB3E4DDF65B60F500024BA0DB55D3EAA59450AAB9

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: 375ee97a820c2ddf17ebd87f02f20ee2f8afeeea92a135757b731e7364b890fb
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: 375ee97a820c2ddf17ebd87f02f20ee2f8afeeea92a135757b731e7364b890fb
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: cef1619c9ddb93373a3b26c2c3d895f019988db76d1b257518542825d62f9407
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: cef1619c9ddb93373a3b26c2c3d895f019988db76d1b257518542825d62f9407
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 020B7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020B76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 020B796D
RegCloseKey.ADVAPI32(?), ref: 020B797E

Strings

PromptOnSecureDesktop, xrefs: 020B76C5, 020B76CA, 020B76E5

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: c37e05cf11f9d367b262cc820ceea0ca51ba642ada62f67c63864b780d0309ba
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: AB11DF32A00209AFDB238F69DC44FEFBFB9EF85304F140151F510E62A0E3B089409B60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 020B9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 020B999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 020B99BD
RegCloseKey.ADVAPI32(?), ref: 020B99C6

Strings

PromptOnSecureDesktop, xrefs: 020B9989, 020B998E, 020B99B0, 020B99D3

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 026134e0592d24479ddf96465cfa04e045e8c15bdb34230dc86faad89c388a30
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 7DF096B2680208BFF7226B54EC06FDF3A2DDF95B14F104061FA05B5091F6E59A9096BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 020B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 020B28FA
gethostbyname.WS2_32(u6A), ref: 020B2906

Strings

time_cfg, xrefs: 020B28EB
u6A, xrefs: 020B28EC, 020B28F9, 020B2905

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 0b19078f5ef8ec188b396e30a9762471c5d75feb92a8c00fe74a039b75b05243
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: F6E0C2306052119FCBA28B2CF848AC537E4EF0A230F008580F844D31A0C734DCC0A780

Function 020B69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 020B69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 020B6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 020B6A3A
CloseHandle.KERNEL32(000000FF), ref: 020B6BD8

Part of subcall function 020BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,020B1DCF,?), ref: 020BEEA8
Part of subcall function 020BEE95: HeapFree.KERNEL32(00000000), ref: 020BEEAF

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 01d3545f48b3ba396aceb0a4ef73ee510a9fb9b7617d5a5c0625c35119e71aa6
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: F671F57190021DEFDF229FA4CC80EEEBBB9FF08354F10456AE515A6190D7719E92EB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: b81ff642ec8c405db45b3491a41a5ff03a93d7a0b594a8e685d163348fa56039
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: b81ff642ec8c405db45b3491a41a5ff03a93d7a0b594a8e685d163348fa56039
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 020B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 020B41AB
GetLastError.KERNEL32 ref: 020B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 020B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 020B41D9

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 3aea55bbbdbe87a7dff48ae83d648c1dea204ceecc7f3d0bbb61ae934cd5b7cd
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B001257691120AABDF12DF90ED84BEE3BACEF18259F008461F901E2050D7709B609BB6

Function 020B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 020B421F
GetLastError.KERNEL32 ref: 020B4229
WaitForSingleObject.KERNEL32(?,?), ref: 020B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 020B424D

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 96c06ea3fa6e0fa098199a9f03cc43d734dec729951d67beff7dc3dafb17f46c
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: EA01E572911209ABDF12DF90ED84BEE7BACEF08255F418061F901E2051D7709A54ABB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 020BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 020BE066

Strings

A, xrefs: 020BE036
A, xrefs: 020BE037, 020BE03C
A, xrefs: 020BE07F

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: c72e62088ac3987e448c3d1c33efa8cef92556f74f35c88a2a2a6a14a11289cb
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: D3F06D322007029BCB73CF25D884AC2B7F9FF09325B848A2AE659C3160D374B8D8DB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 020BE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,020B44E2,00000000,00000000,00000000), ref: 020BE470
CloseHandle.KERNEL32(00000001,00000003), ref: 020BE484

Part of subcall function 020BE2FC: RegCreateKeyExA.ADVAPI32(80000001,020BE50A,00000000,00000000,00000000,00020106,00000000,020BE50A,00000000,000000E4), ref: 020BE319
Part of subcall function 020BE2FC: RegSetValueExA.ADVAPI32(020BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020BE38E
Part of subcall function 020BE2FC: RegDeleteValueA.ADVAPI32(020BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 020BE3BF
Part of subcall function 020BE2FC: RegCloseKey.ADVAPI32(020BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,020BE50A), ref: 020BE3C8

Strings

PromptOnSecureDesktop, xrefs: 020BE4F1, 020BE4F6, 020BE537, 020BE561

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: a2621d0e46eac62de182caa9a776c8e43d88516f761756839c18f06837726450
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 0241B3B2D40308BAEB326F51CC45FEB3BACEF05724F548125FA0994191E7B58650EAA4

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: 8be28398c9b64518b0c2b4a9ca03f67626971bf670fb2bb82cd1ddcbbc63f74b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: 8be28398c9b64518b0c2b4a9ca03f67626971bf670fb2bb82cd1ddcbbc63f74b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 020B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 020B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 020B8477

Part of subcall function 020B69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 020B69E5
Part of subcall function 020B69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 020B6A26
Part of subcall function 020B69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 020B6A3A

Part of subcall function 020BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,020B1DCF,?), ref: 020BEEA8
Part of subcall function 020BEE95: HeapFree.KERNEL32(00000000), ref: 020BEEAF

Strings

PromptOnSecureDesktop, xrefs: 020B83B2, 020B83B7, 020B8483

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 18469f3522df28c08b9198e961927124c79e52f9432de062d34b5cad2631fa4f
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: F74163B2900209BFDB33ABA49D84EFF77ADEF04304F0484A6E504D7160E7705A549B64

Function 020BE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,020BE859,00000000,00020119,020BE859,PromptOnSecureDesktop), ref: 020BE64D
RegCloseKey.ADVAPI32(020BE859,?,?,?,?,000000C8,000000E4), ref: 020BE787

Strings

PromptOnSecureDesktop, xrefs: 020BE637

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 5a102d11cc27b2b5d69c8784e108caf4a88dab27edd4686924da40e719d3f682
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 8D4109B2D0021DBFDF22EFA4DC85DEEBBB9FF04344F544466EA00A6150E3719A55AB60

Function 020BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 020BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 020BB00D

Part of subcall function 020BAF6F: gethostname.WS2_32(?,00000080), ref: 020BAF83
Part of subcall function 020BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 020BAFE6

Part of subcall function 020B331C: gethostname.WS2_32(?,00000080), ref: 020B333F
Part of subcall function 020B331C: gethostbyname.WS2_32(?), ref: 020B3349

Part of subcall function 020BAA0A: inet_ntoa.WS2_32(00000000), ref: 020BAA10

Strings

%OUTLOOK_BND_, xrefs: 020BB076, 020BB07B, 020BB0BE, 020BB0DD

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: 81300da70221dc085e3d3f3ed83514ce282ade3da381cdd6fb427193d005f67e
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 08412F7290030DABDB36EFA0DC49EEE3BADFF08304F144426F92592151EA75D6549F54

Function 020B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 020B9536
Sleep.KERNEL32(000001F4), ref: 020B955D

Strings

, xrefs: 020B94D9

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 6e7e213be56f713982f0420fc86156c3e02ba86d94e5ef28bee9c9a62d09bb96
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 9D41257184838D6FEBB78B64DC9CBEA3FE49F02314F1840A5D282971A2D7B44981EF11

Function 020BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 020BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 020BBA3A
InterlockedIncrement.KERNEL32(?), ref: 020BBA94
GetTickCount.KERNEL32 ref: 020BBB79
GetTickCount.KERNEL32 ref: 020BBB99
InterlockedIncrement.KERNEL32(?), ref: 020BBE15
closesocket.WS2_32(00000000), ref: 020BBEB4

Strings

%FROM_EMAIL, xrefs: 020BBC7D

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 92380a855041da6e06a83263d5c844db06d7806671b907855842c57ca87c8caa
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 43316A715003489FDF76DFA4DC84AEEB7A9EF48704F204456FA2582160EB749A85DF10

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: e1f66ca458b0c02b098c3f9bf5ab9d6aa128bf2eae483acf175470e5a77abb1b
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: e1f66ca458b0c02b098c3f9bf5ab9d6aa128bf2eae483acf175470e5a77abb1b
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 020B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 020B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 020B70F4

Strings

|, xrefs: 020B70E6

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d749a97d7e52f992994e23099d584e76ba884f137f567051843b04bf6cbe4c6a
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: B3112A73900218EBDB62CBD8DC84ADEB7BCAF44305F1441A6E501E60A4D7709B88DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: a08d305d75887146466c199ddd6057d320457f51b90cc9ea0957b561bafc3010
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: a08d305d75887146466c199ddd6057d320457f51b90cc9ea0957b561bafc3010
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 020B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 020B2F88: GetModuleHandleA.KERNEL32(?), ref: 020B2FA1
Part of subcall function 020B2F88: LoadLibraryA.KERNEL32(?), ref: 020B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 020B31DA
HeapFree.KERNEL32(00000000), ref: 020B31E1

Memory Dump Source

Source File: 00000000.00000002.1729199823.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 9465b5716c29b89ebf8e3702e36db19eb311442702c92e17e8a0dcb1a06907d9
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 01518E71900346EFCB229F64DC88AFAB7B5FF05305F2445A9EC96D7210E7329A19DB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1728388128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1728388128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_I5vhb7vJPS.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 844cf183498a50414e2a144f10c99375846975ccfb8c44de2e9068b35b99d8d8
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 844cf183498a50414e2a144f10c99375846975ccfb8c44de2e9068b35b99d8d8
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: wzsddmnn.exePID: 7424, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	0%
Total number of Nodes:	1563
Total number of Limit Nodes:	12

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\I5vhb7vJPS.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

jjcfhqgg, xrefs: 0040A389, 0040A397
%X%08X, xrefs: 0040A0B0
P, xrefs: 00409DAA
\, xrefs: 00409D0C
", xrefs: 00409EDB
D, xrefs: 00409F8E
C:\Users\user\Desktop\I5vhb7vJPS.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 0040A078
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 0040A1D9
", xrefs: 0040A189

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\I5vhb7vJPS.exe$C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$D$P$\$jjcfhqgg
API String ID: 2089075347-1809632314
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0063003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0063024D

Strings

kernel32.dll, xrefs: 0063008F, 00630095
cess, xrefs: 0063018D

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 8f69342a498a25bf33f9362e99804d6d805f6cc08e10f7a952bbbdd345a8224a
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: AF527874A00229DFDB64CF58C995BA8BBB1BF09314F1480D9E90DAB351DB30AE89DF54

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 004A2848 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 004A2870
Module32First.KERNEL32(00000000,00000224), ref: 004A2890

Memory Dump Source

Source File: 0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0049E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_49e000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f5fdba7060cbfd2bc63eb72bed9c07068ad8b5ba766cc4bdabdd82abffd30ff0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EBF0C2311003156BE7203BFDAA8CA6F76E8AF5A764F10062EF642911C0CBB8E8055664

Function 00630E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00630223,?,?), ref: 00630E19
SetErrorMode.KERNELBASE(00000000,?,?,00630223,?,?), ref: 00630E1E

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4b3f2dadeb50f47f9dffb3410bc12ca49dcb814039e7263dfb2ecc5297b295b0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 9ED0123124512877D7003A94DC09BCD7B1CDF05B62F008411FB0DD9180C770994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 004A2507 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004A2558

Memory Dump Source

Source File: 0000000B.00000002.1756464706.000000000049E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0049E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_49e000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 759f0846f8835942c98649e0a8f44c42249d4900c90d0777b9c83076a7089925
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 89113C79A00208FFDB01DF98CA85E99BBF5AF08350F058095F9489B362D375EA50EF84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 006365E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006365F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00636610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00636631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00636652

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 5bad7fdd52d554cae1eae1fe8eda0c1382e109d6d69530795b6882f4ba48f2be
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: BC115171600218BFDB219F65DC46F9B3FA9EB057A5F108034FA09A7251D7B1DD4086A4

Function 00639EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00639E6D
lstrcpy.KERNEL32(?,00000000), ref: 00639FE1
lstrcat.KERNEL32(?,?), ref: 00639FF2
lstrcat.KERNEL32(?,0041070C), ref: 0063A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0063A054
DeleteFileA.KERNEL32(?), ref: 0063A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0063A0D6
lstrcpy.KERNEL32 ref: 0063A12F
lstrlen.KERNEL32(00000022), ref: 0063A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00639F13

Part of subcall function 00637029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00637081

Part of subcall function 00636F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ddwzbkaa,00637043), ref: 00636F4E
Part of subcall function 00636F30: GetProcAddress.KERNEL32(00000000), ref: 00636F55
Part of subcall function 00636F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00636F7B
Part of subcall function 00636F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00636F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0063A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0063A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0063A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0063A21B
GetDriveTypeA.KERNEL32(?), ref: 0063A265
lstrcat.KERNEL32(?,00000000), ref: 0063A29F
lstrcat.KERNEL32(?,00410A34), ref: 0063A2C5
lstrcat.KERNEL32(?,00000022), ref: 0063A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0063A2F4
wsprintfA.USER32 ref: 0063A31D
lstrcat.KERNEL32(?,00000000), ref: 0063A345
lstrcat.KERNEL32(?,?), ref: 0063A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0063A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0063A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0063A1D1

Part of subcall function 00639966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0063999D
Part of subcall function 00639966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006399BD
Part of subcall function 00639966: RegCloseKey.ADVAPI32(?), ref: 006399C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0063A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0063A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0063A41D

Strings

D, xrefs: 0063A1F5
", xrefs: 0063A3F0
\, xrefs: 00639F73
", xrefs: 0063A142
P, xrefs: 0063A011
", xrefs: 0063A2DF

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 004cfa5f0f547e74694f3e89fe23c81aca41e03a637ba42b0df4c0efa34ac21d
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 16F153B1D40259AFDF11DBA0CC49EEF7BBDAB08304F0440AAF645E2151E7B58A85CFA5

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
NtQueryInformationToken, xrefs: 00401262
NtSetInformationThread, xrefs: 00401155
RtlNtStatusToDosError, xrefs: 00401194
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationToken, xrefs: 00401175
ntdll.dll, xrefs: 0040100D
NtFilterToken, xrefs: 0040122B
NtTerminateProcess, xrefs: 004010F6
NtOpenProcessToken, xrefs: 004011D4
RtlFreeSid, xrefs: 00401116
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlInitUnicodeString, xrefs: 00401135
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlLengthSid, xrefs: 00401246

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Nov, xrefs: 0040B29C
Oct, xrefs: 0040B295
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Jan, xrefs: 0040B256
Mar, xrefs: 0040B264
Fri, xrefs: 0040B248
Sun, xrefs: 0040B225
Feb, xrefs: 0040B25D
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Mon, xrefs: 0040B22C
May, xrefs: 0040B272
Wed, xrefs: 0040B23A
Jun, xrefs: 0040B279
Tue, xrefs: 0040B233

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$D
API String ID: 2976863881-3478025276
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00637CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00637D21
GetUserNameA.ADVAPI32(?,?), ref: 00637D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00637DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00637DC0
EqualSid.ADVAPI32(?,?), ref: 00637DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00637E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00637E12
LocalFree.KERNEL32(00000000), ref: 00637E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00637E35

Strings

D, xrefs: 00637D73
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 00637F49, 00637F76, 00637F8A, 00637F8B

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$D
API String ID: 2976863881-3478025276
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 6e3f48ecac669917def4e4b7361602fdd4ae7414a53102948d186a8c8a6f3d58
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 78A131B1900219AFDF21DFA1DD48FEEBBB9FB08300F148069F515E6250DB759A85CBA4

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

localcfg, xrefs: 0040AB0B
., xrefs: 0040A8CA
Too big smtp respons (%d bytes), xrefs: 0040A9B1
rcpt to:<%s>, xrefs: 0040A855
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
AUTH LOGIN, xrefs: 0040A80C
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ESMTP, xrefs: 0040AA38
data, xrefs: 0040A85E
ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
mail from:<%s>, xrefs: 0040A848

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00637A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00637A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637ACD
GetLengthSid.ADVAPI32(?), ref: 00637ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00637B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00637B1F
EqualSid.ADVAPI32(?,?), ref: 00637B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00637B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00637B77
LocalFree.KERNEL32(00000000), ref: 00637B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00637B9A
GetAce.ADVAPI32(?,?,?), ref: 00637BCA
EqualSid.ADVAPI32(?,?), ref: 00637BF1
DeleteAce.ADVAPI32(?,?), ref: 00637C0A
EqualSid.ADVAPI32(?,?), ref: 00637C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00637CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00637CE0
LocalFree.KERNEL32(00000000), ref: 00637CEE

Strings

D, xrefs: 00637AC3

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 2777732776f2b663c83719a6f685171ed4a96a91360503122fc8cd2e2c1b8299
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: D4814CB190421AAFDB21CFA5DD84FEEBBB9AF08304F14806AE505E6250D7759A41CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$localcfg
API String ID: 237177642-230564873
Opcode ID: e56aa1dd170c8f00fbf59b9ba8cc7407dc25a627227ec8cef7c3cf2c020b1006
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: e56aa1dd170c8f00fbf59b9ba8cc7407dc25a627227ec8cef7c3cf2c020b1006
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

useless, xrefs: 0040161E
<, xrefs: 00401378
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
uac, xrefs: 00401628
PDu, xrefs: 0040139A
wusa.exe, xrefs: 00401388
@, xrefs: 00401380
D, xrefs: 004015C6

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
IsWow64Process, xrefs: 00401DF2
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
start_srv, xrefs: 00401E6C
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
kernel32, xrefs: 00401DF7
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0063858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0063865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0063867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006386A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006386B1

Strings

", xrefs: 0063896C
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 0063882F, 0063883C, 0063884C

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe
API String ID: 237177642-143310522
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: a18becb90527f311f467a174d3446e6361bbc5c70b801adc32c65c389fe62b62
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: BCC1A3B1D00249BEEB11ABA4DD86EEF7B7EEB05300F144079F504E7191EB714E948BA5

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 006314E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00631601
lstrlenW.KERNEL32(-00000003), ref: 006317D8

Strings

D, xrefs: 0063182D
, xrefs: 006316C9
@, xrefs: 006315E7
<, xrefs: 006315DF

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: caf068128540a797aff35b05673888e39df15d97756dd447b1f92ccaa41d67af
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: AEF18EB15083419FD720CF64C888BABB7E6FB8A305F10892DF5959B390D7B4D944CBA6

Function 00637666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006376D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00637757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0063778F
___ascii_stricmp.LIBCMT ref: 006378B4
RegCloseKey.ADVAPI32(?), ref: 0063794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0063796D
RegCloseKey.ADVAPI32(?), ref: 0063797E
RegCloseKey.ADVAPI32(?), ref: 006379AC
RegCloseKey.ADVAPI32(?), ref: 00637A56

Part of subcall function 0063F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0063772A,?), ref: 0063F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006379F6
RegCloseKey.ADVAPI32(?), ref: 00637A4D

Strings

", xrefs: 00637800

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 57b2417277589b53b9b4f3a2c5b74244d83629d32dfa0540b7e528a7101182fd
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: D1C1B4B2904209AFDB21DBA4DC45FEE7BBAEF45310F1041A5F504E6291EB71DE84CBA4

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 00632CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00632CED
socket.WS2_32(00000002,00000002,00000011), ref: 00632D07
htons.WS2_32(00000000), ref: 00632D42
select.WS2_32 ref: 00632D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00632DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00632E62

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: d71569b7471ba7dbebee5f49c3f3236771afe35fb4fd1cd00a3cbb7167fba193
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 5061DC71904306ABC320AF64DC19BABBBE9EF88741F15481DF98496261D7B498808BE6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 3e11a711921d160b0f1aac263f823a8e39ac5cf0b0624a850b45692c28cf4611
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: 3e11a711921d160b0f1aac263f823a8e39ac5cf0b0624a850b45692c28cf4611
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00633059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00633068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00633078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00633095
RtlAllocateHeap.NTDLL(00000000), ref: 006330B6
htons.WS2_32(00000035), ref: 006330EF
inet_addr.WS2_32(?), ref: 006330FA
gethostbyname.WS2_32(?), ref: 0063310D
HeapFree.KERNEL32(00000000), ref: 0063314D

Strings

iphlpapi.dll, xrefs: 00633062, 00633067, 00633077

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b7ce875e1c3804ed96ec611f1493cc241e1cd41100721c13529a808386e9a7d6
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: E131C831A0021AABDF119BB89C48AEE77B9EF04761F148225F518E7390DB74DE41CBD8

Function 0063958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006395A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006395D5
GetModuleFileNameA.KERNEL32(00000000), ref: 006395DC
wsprintfA.USER32 ref: 00639635
wsprintfA.USER32 ref: 00639673
wsprintfA.USER32 ref: 006396F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00639758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0063978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006397D8

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 2cf3711e6ba9614781d0edf08d5aca55e179651d3d9362ce0c60e4abaa18d653
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 49A16EB1900208AFEB21DFA0DC45FDA3BAEEB45741F10402AFA15D6291E7B5D984CFE5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: b366c7dbd41046e3dcbc2770e1e20e14b6b6a067fcbdbe8acda447745b45d8a3
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: b366c7dbd41046e3dcbc2770e1e20e14b6b6a067fcbdbe8acda447745b45d8a3
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 00636778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006367C3
htonl.WS2_32(?), ref: 006367DF
htonl.WS2_32(?), ref: 006367EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006368F1
ExitProcess.KERNEL32 ref: 006369BC

Strings

localcfg, xrefs: 00636994
except_info, xrefs: 0063698F

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 487d61afac9911c8e3119cac0c6cc6c50e0df2cd76b304932b20fe69bf254791
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 46615F71940208AFDB609FB4DC45FEA77E9FB08300F24806AFA6DD2161DA7599948F64

Function 0063F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0063CC84), ref: 0063F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0063F5CE
closesocket.WS2_32(00000000), ref: 0063F5DC

Strings

time_cfg, xrefs: 0063F58A

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: fbb37f92a1887dfc506eb2834564df2f2675315ea6eb1172945980f5c984c5e0
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 0E317C72900119ABDB10DFA5DC89DEF7BBDEF89310F10456AF915D3250E7708A818BE4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00632F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00632FA1
LoadLibraryA.KERNEL32(?), ref: 00632FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00632FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00633000
RtlAllocateHeap.NTDLL(00000000), ref: 00633007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00633032

Strings

dnsapi.dll, xrefs: 00632F90

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 09bd20ff1261e82c14aa8b3b1ff62c2aa991749292e49c384c2c148e94a11313
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 2E21A17194022ABBCB219B94DC48AEEBBBDEF08B10F104425F901E7250D7B49E818BE4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 006399E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00639A18
GetThreadContext.KERNEL32(?,?), ref: 00639A52
TerminateProcess.KERNEL32(?,00000000), ref: 00639A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00639A98
SetThreadContext.KERNEL32(?,00010002), ref: 00639AB5
ResumeThread.KERNEL32(?), ref: 00639AC2

Strings

D, xrefs: 00639A10

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f16c523d8f30c708e29e5b5262efa8797f83da662ca81704527373645ea4fd55
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: A9213BB1E01219BBDB119BA1DC09EEF7BBDEF04750F404161BA19E1150EBB58A44CFE4

Function 00631C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00631C18
LoadLibraryA.KERNEL32(004102C8), ref: 00631C26
GetProcessHeap.KERNEL32 ref: 00631C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00631C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00631CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00631D02
FreeLibrary.KERNEL32(?), ref: 00631D0B

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 3899c8cf5ed2b32c0721cc75b8e5540f9dd6f976ca5e8542a9eaf957208c760e
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: E7312D32E00219BFCB119FE4DC888FEBBBAEF46751F24447AE501A6210D7B54E81DB94

Function 00636CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00636CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00636D22
GetLastError.KERNEL32 ref: 00636DA7
CloseHandle.KERNEL32(?), ref: 00636DB5
GetLastError.KERNEL32 ref: 00636DD6
DeleteFileA.KERNEL32(?), ref: 00636DE7
GetLastError.KERNEL32 ref: 00636DFD

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 2dacb412cf5f19b4460555e6b34a913a4c1b92cde5b804d142421098fc2c2847
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2A31E376A00249BFCB01DFA4DD44ADEBF7AEF48310F14C069F251E3261D7708A558BA5

Function 00636F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ddwzbkaa,00637043), ref: 00636F4E
GetProcAddress.KERNEL32(00000000), ref: 00636F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00636F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00636F92

Strings

C:\Windows\SysWOW64\, xrefs: 00636F30, 00636F38, 00636F65, 00636F6C, 00636F7A, 00636F85, 00636F91, 00636FA9, 00636FC6, 00636FEC
\\.\pipe\ddwzbkaa, xrefs: 00636F37

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\ddwzbkaa
API String ID: 1082366364-3028914379
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 4e013b21d21e1265f7aa8448c92996ccea994c831464a8427d3a17fe41b836e0
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 572138A174434079F7325731AC8DFFB2E5E8B52750F1880A9F404D6291DBD988D682ED

Function 0063AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0063AAE5

Strings

localcfg, xrefs: 0063AD72
, xrefs: 0063ABB3

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 0a8a9b341f2e02b6c2333f677700e02bd50ff02f37b7fb33f02f2d9eccbefb32
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 57713E71A00304AADF219BD8DC85FEE776BDF01305F24402AF985A61D1DB629DC4A7DB

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: c9a4f3360f0ec0b24f46105819ecfa8917bdd6cc8a04f69e855d7cbac4ae1cac
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: c9a4f3360f0ec0b24f46105819ecfa8917bdd6cc8a04f69e855d7cbac4ae1cac
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0063E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0063DF6C: GetCurrentThreadId.KERNEL32 ref: 0063DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0063E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00636128), ref: 0063E950
lstrcmp.KERNEL32(?,00000008), ref: 0063E989

Strings

A, xrefs: 0063E9A0
A, xrefs: 0063E8C6, 0063E8CD, 0063E936, 0063E998
A, xrefs: 0063E960, 0063E965

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 506cf07032fb1c3084202cf507d4ec6e24393995c84631ba72cab76013d24748
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: C631AB31600705DFCB718F24C884BAA7BE6EB15320F10892AE596876D1D372EC80CBE5

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: d87e0b72e5304b15b60de58b433867665bba5b378fd0a2a845332a8b1083ea26
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: d87e0b72e5304b15b60de58b433867665bba5b378fd0a2a845332a8b1083ea26
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 00636E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00636E19

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: e1635f87c0701c0d05f4a137682593c4615a3ab26afd32af38becf3028019055
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 89214D7A208115BFDB109B60EC49EDF3FAEDB49361F208425F502D1091EB759A4496B8

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 006392CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006392E2
wsprintfA.USER32 ref: 00639350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00639375
lstrlen.KERNEL32(?,?,00000000), ref: 00639389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00639394
CloseHandle.KERNEL32(00000000), ref: 0063939B

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 84c997330be89b13e3387bb249c11eb0940619c65fe9dff3e5ea2270b2c945e3
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: B21184B17401147BE7606731EC0EFEF3A6EDBC8B10F008069BB09E5091EEB54E4586B8

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0063C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0063C6B4
InterlockedIncrement.KERNEL32(0063C74B), ref: 0063C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0063C747), ref: 0063C728
CloseHandle.KERNEL32(00000000,?,0063C747,00413588,00638A77), ref: 0063C733

Strings

localcfg, xrefs: 0063C544

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: bbdeb712fddf54ce3f67991934c075547a24758b0f0ff920aa6ab823eac5a6bf
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: D3517DB1A01B418FC7648F69C9C552ABBEAFB49310F50593EE18BD7AA0D774F840CB90

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe
API String ID: 124786226-1358119261
Opcode ID: 8781cc80798eaab6ab2ab52eb8b2e9b1a7ed9e2d2e26398b609dffa5b131493d
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 8781cc80798eaab6ab2ab52eb8b2e9b1a7ed9e2d2e26398b609dffa5b131493d
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0063E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0063E50A,00000000,00000000,00000000,00020106,00000000,0063E50A,00000000,000000E4), ref: 0063E319
RegSetValueExA.ADVAPI32(0063E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0063E38E
RegDeleteValueA.ADVAPI32(0063E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dc), ref: 0063E3BF
RegCloseKey.ADVAPI32(0063E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dc,0063E50A), ref: 0063E3C8

Strings

Dc, xrefs: 0063E2FC

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: Dc
API String ID: 2667537340-2761895551
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: bb53dc9b2a09723c03d69832ca0aafdb54d6d47eee161eceb7e17376365d4404
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 3D212C71A0021DABEF209FA5EC89EEE7F7AEF08750F048065F904A6151E6729A54D7E0

Function 006371C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006371E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637228
LocalFree.KERNEL32(?,?,?), ref: 00637286
wsprintfA.USER32 ref: 0063729D

Strings

|, xrefs: 0063721A

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: b5db6882a6b2bdbaaf1f1d776709ad3b8b7d2d21e27e2cdbc9457fa624ddd895
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 443138B2A04208BBCB11DFA8DC45ADA7BBDEF04314F148066F859DB201EA75DB488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 0063B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0063B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0063B548
GetTimeZoneInformation.KERNEL32(?), ref: 0063B590
wsprintfA.USER32 ref: 0063B61E

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: b9a1181937ab5563bde3209f79e38162392356868bbfe48ef7be3ad1fad697f1
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: CC5110B1D0021CAACF14DFD5D8895EEBBB9BF48314F10816AF605A6150E7B84AC9CFD8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 1db0d5f7b6064e75062ff8bfce8a29c92980ee15a886d8a0a9dbcd83443ad8e7
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 1db0d5f7b6064e75062ff8bfce8a29c92980ee15a886d8a0a9dbcd83443ad8e7
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: cdb262ec370b426fde57d6ad7dac50f94a445bc2c3cf148f8403119d86b986b8
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: cdb262ec370b426fde57d6ad7dac50f94a445bc2c3cf148f8403119d86b986b8
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 006362D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 00636303
LoadLibraryA.KERNEL32(?), ref: 0063632A
GetProcAddress.KERNEL32(00000000,?), ref: 006363B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 00636405

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 2029a4bd38f5b4aa6a49df95dbca38b330be382006f9199d71943928c10ce274
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: C4413871A00209BBEB14CF58C884AA9B7FAEF04358F28C169F916D7391E771ED51CB90

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 1d609f471070ccbafc6f86b9a6aefc5b8cbc94f88b448cd9269418e4962c22b1
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 1d609f471070ccbafc6f86b9a6aefc5b8cbc94f88b448cd9269418e4962c22b1
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: c2476777da6022415cc9760e0eaf9e2b6e18cfe20a0c667cff75e655e9f5f1fe
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: c2476777da6022415cc9760e0eaf9e2b6e18cfe20a0c667cff75e655e9f5f1fe
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 006393AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006393C6
GetModuleFileNameA.KERNEL32(00000000), ref: 006393CD
CharToOemA.USER32(?,?), ref: 006393DB
wsprintfA.USER32 ref: 00639410

Part of subcall function 006392CB: GetTempPathA.KERNEL32(00000400,?), ref: 006392E2
Part of subcall function 006392CB: wsprintfA.USER32 ref: 00639350
Part of subcall function 006392CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00639375
Part of subcall function 006392CB: lstrlen.KERNEL32(?,?,00000000), ref: 00639389
Part of subcall function 006392CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00639394
Part of subcall function 006392CB: CloseHandle.KERNEL32(00000000), ref: 0063939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00639448

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: f5299a3414e2ed35a774fd839f4184be02e05f7c37c4f07de4f6ce1e50ca6dfa
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: D2018CF69001187BDB20A7619D89EDF3A7CDB85701F0000A6BB09E2080EAB49AC58FB5

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 006328EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006328FA
gethostbyname.WS2_32(u6A), ref: 00632906

Strings

u6A, xrefs: 006328EC, 006328F9, 00632905
time_cfg, xrefs: 006328EB

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 804fbe3d119bc6b9e3cbf64d1916f936c30dfded86631fefde7783e696738a97
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 7BE012306055129FDB509B2CF848AD677E6EF4A330F058595F454D72A0C774DCC19794

Function 006369C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006369E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00636A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00636A3A
CloseHandle.KERNEL32(000000FF), ref: 00636BD8

Part of subcall function 0063EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00631DCF,?), ref: 0063EEA8
Part of subcall function 0063EE95: HeapFree.KERNEL32(00000000), ref: 0063EEAF

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 1003b99c299bcc470d3bc9513d8c20dfffeaa75b652ee2b8d6ba2c88d41a901a
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8871F671900219BFDB109FA4CC80AEEBBBAFF04354F10856AF515E6290D7319E92DFA4

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0063417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006341AB
GetLastError.KERNEL32 ref: 006341B5
WaitForSingleObject.KERNEL32(?,?), ref: 006341C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006341D9

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: bd7d0cb4826c0380b350c0f7976a2c459ed566241eb8c8444bd8fbecce3bcb0a
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: A301087691110AAFDF01DF90ED84BEF7BADEB18355F108061F901E2150DB70EAA48BB6

Function 006341F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0063421F
GetLastError.KERNEL32 ref: 00634229
WaitForSingleObject.KERNEL32(?,?), ref: 0063423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0063424D

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: ea0e4a60dc2a2aea748a822de16fd9911a8b21fffb54ca1089c97e6233bca0eb
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 9601A572511109ABDF01DF90ED84BEFBBADEB08355F108461F901E2150DBB4AA549BB6

Function 0063E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0063E066

Strings

A, xrefs: 0063E037, 0063E03C
A, xrefs: 0063E036
A, xrefs: 0063E07F

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 319506441815592787c3c3e43c601c06b878116238e8dbed647dc99161b248b7
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 40F06831200701DBCB24CF15D884AC2B7EAFB15321F44862BE154D32A0D3B5E8A4CBA1

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0063E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Dc,00000000,00000000,00000000), ref: 0063E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0063E484

Part of subcall function 0063E2FC: RegCreateKeyExA.ADVAPI32(80000001,0063E50A,00000000,00000000,00000000,00020106,00000000,0063E50A,00000000,000000E4), ref: 0063E319
Part of subcall function 0063E2FC: RegSetValueExA.ADVAPI32(0063E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0063E38E
Part of subcall function 0063E2FC: RegDeleteValueA.ADVAPI32(0063E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dc), ref: 0063E3BF
Part of subcall function 0063E2FC: RegCloseKey.ADVAPI32(0063E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dc,0063E50A), ref: 0063E3C8

Strings

Dc, xrefs: 0063E498, 0063E4BD, 0063E41A, 0063E447, 0063E4C0, 0063E41D, 0063E459, 0063E45A, 0063E46C, 0063E49B

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: Dc
API String ID: 4151426672-2761895551
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 3956e9f66ceec0aab3c86f4087a83a0d4b38aa8e0e0825810b9df1f262608b10
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 8741A971D00214BAEB206B558C46FEB3B6DEB14764F148029F909942D2E7B7CA50DAF5

Function 00638330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006383C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00638477

Part of subcall function 006369C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 006369E5
Part of subcall function 006369C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00636A26
Part of subcall function 006369C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00636A3A

Part of subcall function 0063EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00631DCF,?), ref: 0063EEA8
Part of subcall function 0063EE95: HeapFree.KERNEL32(00000000), ref: 0063EEAF

Strings

C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 0063848C, 006384A1

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe
API String ID: 359188348-1358119261
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 82086fe14c70087d536ee5b5f1b6e800340864b6e75d77224dd258a1d0b820f0
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 094163B290020ABFEB10EBA49D81DFF77BEEB04340F14446AF514D7552FAB15A948BE4

Function 0063AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0063B00D

Part of subcall function 0063AF6F: gethostname.WS2_32(?,00000080), ref: 0063AF83
Part of subcall function 0063AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0063AFE6

Part of subcall function 0063331C: gethostname.WS2_32(?,00000080), ref: 0063333F
Part of subcall function 0063331C: gethostbyname.WS2_32(?), ref: 00633349

Part of subcall function 0063AA0A: inet_ntoa.WS2_32(00000000), ref: 0063AA10

Strings

%OUTLOOK_BND_, xrefs: 0063B076, 0063B07B, 0063B0BE, 0063B0DD

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: c72cb7477f4de11094ba0d93acb51bcf1b48bf78bea79c20f94a0b09fd737b50
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 3141557290020CABDF65EFA0DC46EEF3BADFF04304F14442AF92492152EB75D6548B98

Function 00639452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00639536
Sleep.KERNEL32(000001F4), ref: 0063955D

Strings

, xrefs: 006394D9

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: e07ffa353155b858ca51d2482f7625e1041f4ad3da78268cb7474ef9caf19269
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 9241F5719043846EEB379B68D8897E63BE69B02324F1441A5D48297393D6F44DC2CFB1

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0063BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0063B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0063BA3A
InterlockedIncrement.KERNEL32(?), ref: 0063BA94
GetTickCount.KERNEL32 ref: 0063BB79
GetTickCount.KERNEL32 ref: 0063BB99
InterlockedIncrement.KERNEL32(?), ref: 0063BE15
closesocket.WS2_32(00000000), ref: 0063BEB4

Strings

%FROM_EMAIL, xrefs: 0063BC7D

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: ffb68590f6ec7f3ab0fd45189ab9f4dac5b1b3f41cf5ef3752f03ee71f6983c8
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 9531AE71900248DFDF25DFA8DC85AED77BAEB48700F20506AFB2482261DB70DA85CF94

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0063709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006370BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006370F4

Strings

|, xrefs: 006370E6

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: a2df3d1bf388b35915737aca290f8920978acbef24d4a8176c8f5043041f687e
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 50110CB390411CEBDF21CFD4DC84ADEB7BEAB05711F1841A6E501E6190D6709B88DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00409961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(jjcfhqgg,Function_00009867), ref: 0040996C

Part of subcall function 00409892: SetServiceStatus.SECHOST(00413394), ref: 004098EB

Part of subcall function 004098F2: Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Strings

jjcfhqgg, xrefs: 00409967, 004099AD
hK, xrefs: 00409974, 004099BA

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Service$CtrlHandlerRegisterSleepStatus
String ID: hK$jjcfhqgg
API String ID: 1317371667-1757453468
Opcode ID: ca430b9e4608bea333335a69787ed6bca2f17ce8de0e46e285fa1f472da398df
Instruction ID: 8090f714d00e8c700c7feefac428721607cdcb0429ac14865b211bf96103553c
Opcode Fuzzy Hash: ca430b9e4608bea333335a69787ed6bca2f17ce8de0e46e285fa1f472da398df
Instruction Fuzzy Hash: 55F054F2550308AEE2106F616D87B537548A711349F08C03FB919693D3EBBD4D44822D

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.1756328515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 00633189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00632F88: GetModuleHandleA.KERNEL32(?), ref: 00632FA1
Part of subcall function 00632F88: LoadLibraryA.KERNEL32(?), ref: 00632FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006331DA
HeapFree.KERNEL32(00000000), ref: 006331E1

Memory Dump Source

Source File: 0000000B.00000002.1756575185.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_630000_wzsddmnn.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: cf28a9256ad9dd1a5ff7ebf0d7e1705ccf8cef8eabd759ddb77bc01ff8e995ba
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 7C51AA3190025AAFCB059F68D8889EAB776FF15300F1481A8EC9687311E732DB59CBD4

Analysis Process: svchost.exePID: 7612, Parent PID: 7424COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1806
Total number of Limit Nodes:	18

Executed Functions

Function 004CC913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 004CCA4E
closesocket.WS2_32(?), ref: 004CCB63
GetTempPathA.KERNEL32(00000120,?), ref: 004CCC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004CCCB4
WriteFile.KERNEL32(004CA4B3,?,-000000E8,?,00000000), ref: 004CCCDC
CloseHandle.KERNEL32(004CA4B3), ref: 004CCCED
wsprintfA.USER32 ref: 004CCD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004CCD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 004CCD89
CloseHandle.KERNEL32(?), ref: 004CCD98
CloseHandle.KERNEL32(?), ref: 004CCD9D
DeleteFileA.KERNEL32(?), ref: 004CCDC4
CloseHandle.KERNEL32(004CA4B3), ref: 004CCDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CCFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 004CCFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 004CD033
lstrcatA.KERNEL32(?,03B00108), ref: 004CD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 004CD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 004CD171
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000), ref: 004CD195
CloseHandle.KERNEL32(00000000), ref: 004CD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 004CD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CD231
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 004CD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 004CD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2C7
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 004CD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CD372
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 004CD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 004CD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD408
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 004CD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 004CD45B
CreateProcessA.KERNEL32(?,004D0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004CD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD513
closesocket.WS2_32(?), ref: 004CD56C
Sleep.KERNEL32(000003E8), ref: 004CD577
ExitProcess.KERNEL32 ref: 004CD583
wsprintfA.USER32 ref: 004CD81F

Part of subcall function 004CC65C: send.WS2_32(00000000,?,00000000), ref: 004CC74B

closesocket.WS2_32(?), ref: 004CDAD5

Strings

localcfg, xrefs: 004CCA89, 004CCA93, 004CCAC0, 004CCAD2, 004CCE4F, 004CCE6F, 004CD8D3, 004CD8FC
time_cfg, xrefs: 004CC95B, 004CC962, 004CC971, 004CC984
flags_upd, xrefs: 004CCE4A
\, xrefs: 004CD3A7
.sys, xrefs: 004CD0CC
wtm_r, xrefs: 004CC97F
X M, xrefs: 004CC927, 004CC93C, 004CC9BE
.dat, xrefs: 004CD0D7, 004CD138, 004CD1AE, 004CD1D4, 004CD28E, 004CD308, 004CD3CF, 004CD441
drivers\, xrefs: 004CD067
wtm_c, xrefs: 004CC956
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004CCC10, 004CCCF3, 004CD975, 004CD98E
work_srv, xrefs: 004CD607, 004CD60F, 004CD62C
lid_file_upd, xrefs: 004CCE6A
@, xrefs: 004CD754
\, xrefs: 004CD39D
4, xrefs: 004CD9F7
wtm_w, xrefs: 004CC96C
local_time, xrefs: 004CCACD
srv_time, xrefs: 004CCABB
except_info, xrefs: 004CD8CD, 004CD8D2, 004CD8FB

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$X M$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-952681147
Opcode ID: 8690d6a7c5bae3174519e945a35180a5e7d5f855766719948976ff36180a9717
Instruction ID: a100a9ca9a9ff00bf69c011ea4bb09a6a761a45104768520831e6c248fe7f7f7
Opcode Fuzzy Hash: 8690d6a7c5bae3174519e945a35180a5e7d5f855766719948976ff36180a9717
Instruction Fuzzy Hash: 1DB2C175D01208BBEB609FA5DD85FEE7BA8AB04304F14007FF609A3291D7789A45CB69

Function 004C9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 004C9A7F
SetErrorMode.KERNELBASE(00000003), ref: 004C9A83
SetUnhandledExceptionFilter.KERNEL32(004C6511), ref: 004C9A8A

Part of subcall function 004CEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 004CEC5E
Part of subcall function 004CEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 004CEC72
Part of subcall function 004CEC54: GetTickCount.KERNEL32 ref: 004CEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 004C9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 004C9ABA
GetCommandLineA.KERNEL32 ref: 004C9AFD
lstrlenA.KERNEL32(?), ref: 004C9B99
ExitProcess.KERNEL32 ref: 004C9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 004C9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 004C9D7A
lstrcatA.KERNEL32(?,?), ref: 004C9D8B
lstrcatA.KERNEL32(?,004D070C), ref: 004C9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C9DED
DeleteFileA.KERNEL32(00000022), ref: 004C9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 004C9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 004C9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 004C9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 004C9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 004C9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 004C9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 004C9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004C9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004C9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 004CA038
lstrcatA.KERNEL32(00000022,004D0A34), ref: 004CA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 004CA072
lstrcatA.KERNEL32(00000022,004D0A34), ref: 004CA08D
wsprintfA.USER32 ref: 004CA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 004CA0DE
lstrcatA.KERNEL32(00000022,?), ref: 004CA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004CA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004CA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 004CA174
GetModuleFileNameA.KERNEL32(00000000), ref: 004CA17B
GetDriveTypeA.KERNEL32(00000022), ref: 004CA1B6
GetCommandLineA.KERNEL32 ref: 004CA1E5

Part of subcall function 004C99D2: lstrcpyA.KERNEL32(?,?,00000100,004D22F8,00000000,?,004C9E9D,?,00000022,?,?,?,?,?,?,?), ref: 004C99DF
Part of subcall function 004C99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,004C9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 004C9A3C
Part of subcall function 004C99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,004C9E9D,?,00000022,?,?,?), ref: 004C9A52

lstrlenA.KERNEL32(?), ref: 004CA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 004CA3B7
GetLastError.KERNEL32 ref: 004CA3ED
Sleep.KERNEL32(000003E8), ref: 004CA400
DeleteFileA.KERNELBASE(004D33D8), ref: 004CA407
CreateThread.KERNELBASE(00000000,00000000,004C405E,00000000,00000000,00000000), ref: 004CA42C
WSAStartup.WS2_32(00001010,?), ref: 004CA43A
CreateThread.KERNELBASE(00000000,00000000,004C877E,00000000,00000000,00000000), ref: 004CA469
Sleep.KERNELBASE(00000BB8), ref: 004CA48A
GetTickCount.KERNEL32 ref: 004CA49F
GetTickCount.KERNEL32 ref: 004CA4B7
Sleep.KERNELBASE(00001A90), ref: 004CA4C3

Strings

", xrefs: 004C9EDB
D, xrefs: 004C9F8E
", xrefs: 004CA078
\, xrefs: 004C9D0C
%X%08X, xrefs: 004CA0B0
P, xrefs: 004C9DAA
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004CA1D9
", xrefs: 004CA189
jjcfhqgg, xrefs: 004CA389, 004CA397

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$D$P$\$jjcfhqgg
API String ID: 2089075347-3562732843
Opcode ID: f61c933db9cbb11270716025d22f32e7dafd38ccd34503a40a71075f6b8eb3e9
Instruction ID: 5cb8095f3c29c19dd340804f90d456802daffa6a3e0b71d3e417a04415e4ed8b
Opcode Fuzzy Hash: f61c933db9cbb11270716025d22f32e7dafd38ccd34503a40a71075f6b8eb3e9
Instruction Fuzzy Hash: 03529FB5C01259BBDB519FA19C49FEF7BBCAB04304F1440AFF509A3241EB789E448B69

Function 004C199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004C19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,004C1E9E), ref: 004C19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004C19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004C19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004C19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,004C1E9E), ref: 004C1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,004C1E9E), ref: 004C1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,004C1E9E), ref: 004C1A36
GetAdaptersInfo.IPHLPAPI(00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A5A
GetAdaptersInfo.IPHLPAPI(00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,004C1E9E), ref: 004C1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,004C1E9E), ref: 004C1AA4

Strings

localcfg, xrefs: 004C19A3
GetAdaptersInfo, xrefs: 004C19DC
123.45.67.89, xrefs: 004C19A6
GetBestInterface, xrefs: 004C19EF
Iphlpapi.dll, xrefs: 004C19B7
GetIfEntry, xrefs: 004C19E4

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: f2676e7521df5c5164a363c07c4cf256322c3355d4d1e8b289d666a187859663
Instruction ID: 9c25663d24772396025d7156c49d57cf1f69a125ffc89df425ec10cbdb0d1ff2
Opcode Fuzzy Hash: f2676e7521df5c5164a363c07c4cf256322c3355d4d1e8b289d666a187859663
Instruction Fuzzy Hash: C3313035902219AFCB519FE4DC88EAFBBB5EB46301F24457FE501A3221D7364E41DB98

Function 004C7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 004C7ABA
GetUserNameA.ADVAPI32(?,?), ref: 004C7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,004D070C,?,?,?), ref: 004C7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 004C7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 004C7B59
EqualSid.ADVAPI32(?,00000022), ref: 004C7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004C7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 004C7BAB
LocalFree.KERNEL32(00000000), ref: 004C7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,004C7FC9,?,00000000), ref: 004C7BCE

Strings

D, xrefs: 004C7B0C
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004C7CE2, 004C7D0F, 004C7D23, 004C7D24

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$D
API String ID: 2976863881-3478025276
Opcode ID: 1977a15707287f7ca079574bd377fd091b076032e34fd2d7ce7c9678fd5fffa0
Instruction ID: 6ec50d4adfa6d1099f38c785a0dfd911d6a6cf70c51842579be261a68c969a5d
Opcode Fuzzy Hash: 1977a15707287f7ca079574bd377fd091b076032e34fd2d7ce7c9678fd5fffa0
Instruction Fuzzy Hash: 96A13775905219ABDF528FA1DC88FEFBBB8FB44304F14406BE506E2250E7399A45CF68

Function 004C7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 004C782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004C7866
GetLengthSid.ADVAPI32(?), ref: 004C7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 004C789A
GetSecurityDescriptorOwner.ADVAPI32(?,004C7F63,?), ref: 004C78B8
EqualSid.ADVAPI32(?,004C7F63), ref: 004C78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004C7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 004C7910
LocalFree.KERNEL32(00000000), ref: 004C7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004C7933
GetAce.ADVAPI32(?,00000000,?), ref: 004C7963
EqualSid.ADVAPI32(?,004C7F63), ref: 004C798A
DeleteAce.ADVAPI32(?,00000000), ref: 004C79A3
EqualSid.ADVAPI32(?,004C7F63), ref: 004C79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 004C7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 004C7A79
LocalFree.KERNEL32(00000000), ref: 004C7A87

Strings

D, xrefs: 004C785C

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 8acbe921d2a9653fc26c1c3154f4d2a5aa53819134126722fc4745efa9ed4f46
Instruction ID: bb3cdfcc5c8839d48b68877ec88b4fff277697f14a991773c910a94c12d05310
Opcode Fuzzy Hash: 8acbe921d2a9653fc26c1c3154f4d2a5aa53819134126722fc4745efa9ed4f46
Instruction Fuzzy Hash: 1C814AB5905219ABDF62CFA4DD44FEFBBB8EF08340F14416AE505E2250D7398A41CF68

Function 004C8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C83F3
RegQueryValueExA.KERNELBASE(004D0750,?,00000000,?,004C8893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C8414
RegSetValueExA.KERNELBASE(004D0750,?,00000000,00000004,004C8893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C8441
RegCloseKey.ADVAPI32(004D0750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C844A

Strings

localcfg, xrefs: 004C8348
C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004C85C8, 004C85D5, 004C85E5

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe$localcfg
API String ID: 237177642-230564873
Opcode ID: 2194b7afdfbda0020fc7e227bc202895090f61bb7adef290ccedea8bef5bf868
Instruction ID: 1f7923630974279b9b105d29152d64afbd608d5f2405c21649a262ddd3a612cd
Opcode Fuzzy Hash: 2194b7afdfbda0020fc7e227bc202895090f61bb7adef290ccedea8bef5bf868
Instruction Fuzzy Hash: CFC1BFB9941109BEEB51ABA1DC85FFF7BBCEB14304F14446FF500A2151EBB84E448B29

Function 004C1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 004C1DC6
GetSystemInfo.KERNELBASE(?), ref: 004C1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 004C1E03
GetProcAddress.KERNEL32(00000000), ref: 004C1E0A
GetCurrentProcess.KERNEL32(?), ref: 004C1E1B
GetTickCount.KERNEL32 ref: 004C1FC9

Part of subcall function 004C1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1C15

Strings

localcfg, xrefs: 004C1E2A, 004C1E31, 004C1E44, 004C1E7D, 004C1E8C, 004C1EB2, 004C1ED1, 004C1EE7, 004C1EFF, 004C1F1C, 004C1F34, 004C1F50, 004C1F70
lid_file_upd, xrefs: 004C1E25
flags_upd, xrefs: 004C1E3E, 004C1E43, 004C1E7C
net_type, xrefs: 004C1E87
IsWow64Process, xrefs: 004C1DF2
start_srv, xrefs: 004C1E6C
born_date, xrefs: 004C1EAD, 004C1ECC
hi_id, xrefs: 004C1F16, 004C1F1B, 004C1F33
kernel32, xrefs: 004C1DF7
loader_id, xrefs: 004C1F4B, 004C1F6B
work_srv, xrefs: 004C1E5E

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 23a3ee1c19b32b2a7bdea0fe0dc94892d0b1c56ce3f9b9d5b8f6280513bcc846
Instruction ID: be44684a5d79c70be11013badcb5d67442974d2e9173c6ecd2242b35859a4909
Opcode Fuzzy Hash: 23a3ee1c19b32b2a7bdea0fe0dc94892d0b1c56ce3f9b9d5b8f6280513bcc846
Instruction Fuzzy Hash: 235195B49043446FE3B0AF768C85F2B7AECEB55708F04492FB94683253D77DA9048769

Function 004C73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 004C7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C7528
___ascii_stricmp.LIBCMT ref: 004C764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 004C7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004C77EF

Part of subcall function 004CF1A5: lstrlenA.KERNEL32(000000C8,000000E4,004D22F8,000000C8,004C7150,?), ref: 004CF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C778F
RegCloseKey.KERNELBASE(?), ref: 004C77E6

Strings

", xrefs: 004C7599

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 79560e82c82d19570009996dd84836467f404d8bc0b51fb9d8f3344adf34f6de
Instruction ID: b3fd2d6ad0afa54d0c24b1ebf8771612cf54dc2818dbf12b8392dc53a9debc23
Opcode Fuzzy Hash: 79560e82c82d19570009996dd84836467f404d8bc0b51fb9d8f3344adf34f6de
Instruction Fuzzy Hash: 62C1B079904209BBDB519BA5DC45FEFBBB9EF44310F1000AFF504A6291EB789A408F68

Function 004C675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 004C677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 004C679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004C67B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004C67BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004C67D3
ReadFile.KERNELBASE(000000FF,?,00000040,004C8244,00000000,?,74DF0F10,00000000), ref: 004C6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 004C681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 004C683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 004C685C
ReadFile.KERNEL32(000000FF,?,00000028,004C8244,00000000,?,74DF0F10,00000000), ref: 004C688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 004C6906
ReadFile.KERNEL32(000000FF,?,00000000,004C8244,00000000,?,74DF0F10,00000000), ref: 004C691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 004C6971

Part of subcall function 004CEC2E: GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
Part of subcall function 004CEC2E: RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 5d3e005705b349f67ce69c0f2446ea59b372afb959a3e0fb8d32f1294bdbbb95
Instruction ID: bf5922110d18c6c11a0b709b3d194403ecf5d6cf75bca7b1e40bc5a00df5f1d2
Opcode Fuzzy Hash: 5d3e005705b349f67ce69c0f2446ea59b372afb959a3e0fb8d32f1294bdbbb95
Instruction Fuzzy Hash: F47166B5C0121DEFDF509FA5CC80EEEBBB8FB04314F10856AE515A2290E7349E92CB64

Function 004CF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(004CCA1D), ref: 004CF34D
socket.WS2_32(00000002,00000001,00000000), ref: 004CF367
closesocket.WS2_32(00000000), ref: 004CF375

Strings

time_cfg, xrefs: 004CF323

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 83b7ab5e6058df1727f1f1487a53e0c149fc0779a24516ebd56f4b1ef58bf84e
Instruction ID: c39220a23dd9690d3b521b19f658dac224943257093026e3e1051e97238cc6b1
Opcode Fuzzy Hash: 83b7ab5e6058df1727f1f1487a53e0c149fc0779a24516ebd56f4b1ef58bf84e
Instruction Fuzzy Hash: 74318976901118ABDB109FA5DC89EEF7BBDEF88314F10417BF904E3151E7388A458BA9

Function 004C405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 004C4070
ExitProcess.KERNEL32 ref: 004C4121

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 8b6a2896d3d71baaa961411df4dff926d4c3680ed32d04b60a71cf3e83e3e911
Instruction ID: 36d6b8290b0bc396220fa67845fc18102dd17452b85ea6109ce16c45703e0ade
Opcode Fuzzy Hash: 8b6a2896d3d71baaa961411df4dff926d4c3680ed32d04b60a71cf3e83e3e911
Instruction Fuzzy Hash: 9F51B379D40218BAEB61ABA19D46FFF7B7CEB51754F00406EF600A2180E7388E41C769

Function 004C2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,004C2F01,?,004C20FF,004D2000), ref: 004C2D3A
LoadLibraryA.KERNEL32(?), ref: 004C2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 004C2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 004C2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 004C2D99
HeapAlloc.KERNEL32(00000000), ref: 004C2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 004C2DCB

Strings

DnsQuery_A, xrefs: 004C2D5B
dnsapi.dll, xrefs: 004C2D29

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: a983b52d9c65033a1cf2640e5bab25d649244df21b7f1cf72c93b882e288ba58
Instruction ID: 06294e99192087418dbae00ac9651e2b847475669d1d77a227148aa392dd9859
Opcode Fuzzy Hash: a983b52d9c65033a1cf2640e5bab25d649244df21b7f1cf72c93b882e288ba58
Instruction Fuzzy Hash: 61218E75901226ABCB629F54DD44FAFBBB8EF18B51F10402BF906E3210D7F4998287D8

Function 004C80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004C815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,004CA45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004C8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,004CA45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004C81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004C8210

Part of subcall function 004C675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 004C677E
Part of subcall function 004C675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 004C679A
Part of subcall function 004C675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004C67B0
Part of subcall function 004C675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004C67BF
Part of subcall function 004C675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004C67D3
Part of subcall function 004C675C: ReadFile.KERNELBASE(000000FF,?,00000040,004C8244,00000000,?,74DF0F10,00000000), ref: 004C6807
Part of subcall function 004C675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 004C681F
Part of subcall function 004C675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 004C683E
Part of subcall function 004C675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 004C685C

Part of subcall function 004CEC2E: GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
Part of subcall function 004CEC2E: RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Strings

C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe, xrefs: 004C8225, 004C823A

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe
API String ID: 124786226-1358119261
Opcode ID: a6ce23b9b4dad802ff40be461632070619f3a511a897373ba9fd29396c205121
Instruction ID: b30c12d9c3a2a0153eba5087d79327ef05d23534c6a313614d966301ad95166d
Opcode Fuzzy Hash: a6ce23b9b4dad802ff40be461632070619f3a511a897373ba9fd29396c205121
Instruction Fuzzy Hash: A841A0BA801108BFEB50EBA19D85FBF77ACAB10304F1448AFF500A3101EA785E458B29

Function 004C1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

Strings

Iphlpapi.dll, xrefs: 004C1ACC
GetAdaptersAddresses, xrefs: 004C1AE3

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: bcfeb8351b26dd430fb932425aad04a11a0da05162be3e1ca80fc0f9546dfa68
Instruction ID: e7945856197881a6cb1cfc5fa4cd2432ed7d16091f95d92a7f78ff44ed4fe2fe
Opcode Fuzzy Hash: bcfeb8351b26dd430fb932425aad04a11a0da05162be3e1ca80fc0f9546dfa68
Instruction Fuzzy Hash: 6711EB79E01124AFCB55D765CC84EAEFB79EB45B10B14405FE005A3222F6346D40CF88

Function 004CE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,004CE5F2,00000000,00020119,004CE5F2,004D22F8), ref: 004CE3E6
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 004CE44E
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 004CE482
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,80000001,?), ref: 004CE4CF
RegCloseKey.ADVAPI32(004CE5F2,?,?,?,?,000000C8,000000E4), ref: 004CE520

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 649f5f8e5a92648f686a7a720046e11813166255c8a428176089064178d52309
Instruction ID: b8f8f3aefaf37dabc84abe4e5425037d6d19e8adfe8c8a01e34f08387a3e04f5
Opcode Fuzzy Hash: 649f5f8e5a92648f686a7a720046e11813166255c8a428176089064178d52309
Instruction Fuzzy Hash: 5D4116B6D00219BFEF519FD5DC85EEEBBB9EB04308F04406AE900A3250E7359E158B64

Function 004CF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 004CF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 004CF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 004CF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004CF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 004CF2FD

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 81807dddde636a90fe62178a9dc5666e0de447ff30f643ca3f14807382342287
Instruction ID: 7020d5dd1ac2147338e7c1a5463582ea88f23728a87cc5fff590694fd726f095
Opcode Fuzzy Hash: 81807dddde636a90fe62178a9dc5666e0de447ff30f643ca3f14807382342287
Instruction Fuzzy Hash: EE11F8B2A40248BAEB11DF94CD85F9E7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 004C1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004C1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
Part of subcall function 004C1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
Part of subcall function 004C1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 004C1C51

Strings

localcfg, xrefs: 004C1BE7
hi_id, xrefs: 004C1BE5

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: a392e8fcad37e42b50e6c937fd3c7a9f95ec119a41c5a9110bd4f2d3238b1011
Instruction ID: fc03980164d26091c2db3cd27fd538b48fdc75ed6ec25112f80e5056ac859d8f
Opcode Fuzzy Hash: a392e8fcad37e42b50e6c937fd3c7a9f95ec119a41c5a9110bd4f2d3238b1011
Instruction Fuzzy Hash: 20018476940118BBEB50DAE8C8C5EFFBBBCE745745F10047BE602E3211D1349D448665

Function 004C1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 004C1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
Part of subcall function 004C1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
Part of subcall function 004C1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,004C1EFD,00000000,00000000,00000000,00000000), ref: 004C1BB8

Strings

localcfg, xrefs: 004C1B7B

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: fa51b747c8af020cb4c59680d727b0a96ed43b6b13f4e56d8a4b5cca5ff97612
Instruction ID: 763ed7ec511304c39427c2b0a6000081a4a4114eee7059e898d76135b2beb928
Opcode Fuzzy Hash: fa51b747c8af020cb4c59680d727b0a96ed43b6b13f4e56d8a4b5cca5ff97612
Instruction Fuzzy Hash: 25018BB6D00108BFEB01ABE9CC81EEFFBBCEB48654F150066A601E3151E6706E084AA0

Function 004C2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 004C2693
gethostbyname.WS2_32(00000001), ref: 004C269F

Strings

time_cfg, xrefs: 004C2684

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 6486d3924a99b119a27ff4ebf1cf9ac6b93f1092382cfccfc070afd42fecdcbc
Instruction ID: ca9bee86f090582709e2f901dec703f6204462fe90764606b7f77a3b573f81d4
Opcode Fuzzy Hash: 6486d3924a99b119a27ff4ebf1cf9ac6b93f1092382cfccfc070afd42fecdcbc
Instruction Fuzzy Hash: 3FE08C342060218FCB909B28F848F8A37A4AF16330F01418AF480C72A0C7B4DC8097A8

Function 004CEC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004CEBA0: GetProcessHeap.KERNEL32(00000000,00000000,004CEC0A,00000000,80000001,?,004CDB55,7FFF0001), ref: 004CEBAD
Part of subcall function 004CEBA0: HeapSize.KERNEL32(00000000,?,004CDB55,7FFF0001), ref: 004CEBB4

GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Strings

'L, xrefs: 004CEC2F, 004CEC37, 004CEC3E

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'L
API String ID: 1305341483-3688640772
Opcode ID: c7ee7a45117c9cf5c8d83703ef37cd71fc30d4634c2a11b36743667587a83fe6
Instruction ID: c8902f186d44ec25d74ca9e5fd1b13c928a0b77e6b237237861398353d4e962b
Opcode Fuzzy Hash: c7ee7a45117c9cf5c8d83703ef37cd71fc30d4634c2a11b36743667587a83fe6
Instruction Fuzzy Hash: 79C012324072306BC5912751BC0DFAF6B189F46711F0D441FF4056715487645C4086E9

Function 004CE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,004CA445), ref: 004CE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,004CA445), ref: 004CE583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,004CA445), ref: 004CE5B2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 84b6b8c2677051e950257a7dab722b0328a5874d57545aea913f21659fd819de
Instruction ID: 6db93406f7f5bccfbfd025f98ae7b8f6c0e05b20d94455add2f8b0bcdba9ae11
Opcode Fuzzy Hash: 84b6b8c2677051e950257a7dab722b0328a5874d57545aea913f21659fd819de
Instruction Fuzzy Hash: 1F21EAB69402007AE2A17A635D07F6B3E5CDB54758F10052FFE09A12E3EB9DE91081BD

Function 004C877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 004C88A5

Part of subcall function 004CF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,004CE342,00000000,75A8EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4), ref: 004CF089
Part of subcall function 004CF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,004CE342,00000000,75A8EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4,000000C8), ref: 004CF093

Strings

localcfg, xrefs: 004C87CA, 004C87CF, 004C87FB, 004C8835, 004C8861
rresolv, xrefs: 004C87F6, 004C885C

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: ff07bbe4faf36107e8122dd1c9ac3397b42f0504d185dbdeee94644fe84cc53c
Instruction ID: 061eadf69b191834441f7436fe5f3f034f8bcf8a92b5501c9566cece7c16e624
Opcode Fuzzy Hash: ff07bbe4faf36107e8122dd1c9ac3397b42f0504d185dbdeee94644fe84cc53c
Instruction Fuzzy Hash: FB21C4391493006AF395B7676E47FAA3BE9DB10B14FA0482FF904961C3EEDD854441BD

Function 004C4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004D22F8,004C42B6,00000000,00000001,004D22F8,00000000,?,004C98FD), ref: 004C4021
GetLastError.KERNEL32(?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C402C
Sleep.KERNEL32(000001F4,?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C4046

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 126130671b69d94768e0de383a77aed4403bf9980874d4aa2bf84be8431f7eb5
Instruction ID: 7c296a97e488d6e6a93d18eb2a170f1dbe5952c0175c34ba2904f80eced29672
Opcode Fuzzy Hash: 126130671b69d94768e0de383a77aed4403bf9980874d4aa2bf84be8431f7eb5
Instruction Fuzzy Hash: 9BF0A7352801016AD7724B26BD59F1B37A1DBC2724F254B2EF3B5E31E0C63448819B1D

Function 004CDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(004CDC19,?,00000104), ref: 004CDB7F
lstrcpyA.KERNEL32(?,004D28F8), ref: 004CDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 004CDBC2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: a1721f348d829c7e0b06347378a14b8c0e5a3a5fcffe4b520ab31fc732df989a
Instruction ID: 06a32206bd6f374b33328171adaa1cc9e5f6f3da8034625a2327b5708c2087cf
Opcode Fuzzy Hash: a1721f348d829c7e0b06347378a14b8c0e5a3a5fcffe4b520ab31fc732df989a
Instruction Fuzzy Hash: D8F09070500209BBEF119F64EC89FD93B69AB10308F1041A5BB55A50D0D7F2E945CB28

Function 004CEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 004CEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 004CEC72
GetTickCount.KERNEL32 ref: 004CEC78

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 8ff3c7fc207da01957c465a6b1dc029bcf877f76f121244bbac8a9dab925e4a4
Instruction ID: 51d59fdee966cb44e6c165f5d13a9b9d09c9ef9c175f831c056677bc20e2d91f
Opcode Fuzzy Hash: 8ff3c7fc207da01957c465a6b1dc029bcf877f76f121244bbac8a9dab925e4a4
Instruction Fuzzy Hash: A9E09AF5811104BFE711ABB0EC4AE6F77BCEB08215F500661B911D6090DA709A058B64

Function 004C30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004C30D8
gethostbyname.WS2_32(?), ref: 004C30E2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: c028fc20f5799f5491a3b7f9712b1c4edd6a1a68f0e5b715d797cae008ce898a
Instruction ID: 008f96053f4b2361c10cb5ada43a85a606c77b089e0523e4a8842f905637bd90
Opcode Fuzzy Hash: c028fc20f5799f5491a3b7f9712b1c4edd6a1a68f0e5b715d797cae008ce898a
Instruction Fuzzy Hash: DCE09B769011199BCF00DBA8EC89F9B77ECFF04308F084066F905E3255EA34E9048794

Function 004CEBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,004CDB55,7FFF0001), ref: 004CEC13
RtlReAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEC1A

Part of subcall function 004CEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
Part of subcall function 004CEBCC: RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 767421176c7de718add4fc5283e6cc8c4559ae24c97f950ade2b871c768b4001
Instruction ID: a6d7f48fcd2e299f916045722a1a5bff2f8bdfe8b35d74ceb0d998316be63305
Opcode Fuzzy Hash: 767421176c7de718add4fc5283e6cc8c4559ae24c97f950ade2b871c768b4001
Instruction Fuzzy Hash: 56E012361052187ADF412B96EC09FAD7B59DB04365F14802AF90D49161DB369990D698

Function 004CEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Part of subcall function 004CEB74: GetProcessHeap.KERNEL32(00000000,00000000,004CEC28,00000000,?,004CDB55,7FFF0001), ref: 004CEB81
Part of subcall function 004CEB74: HeapSize.KERNEL32(00000000,?,004CDB55,7FFF0001), ref: 004CEB88

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: f5545c5ec4272c84696421c470d2b0958f2b75df3b4b21eafbd0d624c0a17144
Instruction ID: 0101197cdf3902b652cba7fd1fb05ae5e1ab00a5343cbb020bfd8a9837907b4f
Opcode Fuzzy Hash: f5545c5ec4272c84696421c470d2b0958f2b75df3b4b21eafbd0d624c0a17144
Instruction Fuzzy Hash: 83C0803610523067C64127A57C0CF9E7F54DF05352F08001AF505C3160C7354C4087A9

Function 004CF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,004CCA44), ref: 004CF476

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: d20e055c3b3a77b6b43181ba240d60e8070aa15aee6ad586c7d80f15b65a5359
Instruction ID: 370582eb186bdd336a1e2efebd7fcb75617cf3b7639b992488765f5d94044c71
Opcode Fuzzy Hash: d20e055c3b3a77b6b43181ba240d60e8070aa15aee6ad586c7d80f15b65a5359
Instruction Fuzzy Hash: AFF08C3620154AAB9B419E9ADC84DAB3BAEFB99310B050137FA04D3110D639E825CBA8

Function 004C1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 004C1992

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4cb469fcc944aa9858e614e28a890652cbbb4d370db0628398c54c03e8584945
Instruction ID: 1932f31a2154ba366c4d7cea5e076c16a83120925415a3d87734f0688273bce8
Opcode Fuzzy Hash: 4cb469fcc944aa9858e614e28a890652cbbb4d370db0628398c54c03e8584945
Instruction Fuzzy Hash: 91D0222A1092312A42402359BC04A7FAB8CCF05262B00802FFC48C0120C638CC41839D

Function 004CDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 004CDDB5

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 9a6a5fac6c1e8b6e35a4547a9f168245bdbb8650cb7a4bf06cd0a95b113d7800
Instruction ID: 574e18dcee573c768c38ef747d77807550a201aa4462f4736a0d8ee488d79d75
Opcode Fuzzy Hash: 9a6a5fac6c1e8b6e35a4547a9f168245bdbb8650cb7a4bf06cd0a95b113d7800
Instruction Fuzzy Hash: 0EF05839E003029BCBA18E249984B67B7E8AB85325F14483FE25A92250DB38DC45CB1A

Non-executed Functions

Function 004C637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,004C9816,EntryPoint), ref: 004C638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,004C9816,EntryPoint), ref: 004C63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004C63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004C63EB

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a94449a7bf0ac5f898afbabb7d68dcc3216b5d717c842f47f77af8b1009c06b5
Instruction ID: 4c66a08ce49fd29e37a8ddcc9ae786a82abf9ad6c992e1763ebecde160e60748
Opcode Fuzzy Hash: a94449a7bf0ac5f898afbabb7d68dcc3216b5d717c842f47f77af8b1009c06b5
Instruction Fuzzy Hash: 3211E3B5600219BFDB518F65DC09F9B3BA8EB047A4F01806AFD08E7290D671DC008AB8

Function 004C1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,004C1839,004C9646), ref: 004C1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004C10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004C10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 004C1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 004C1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 004C1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 004C1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 004C1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 004C119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004C11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004C11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004C11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 004C121A

Strings

NtOpenProcessToken, xrefs: 004C11D4
RtlInitUnicodeString, xrefs: 004C1135
RtlSetLastWin32Error, xrefs: 004C10D6
NtFilterToken, xrefs: 004C122B
NtClose, xrefs: 004C11B4
RtlFreeSid, xrefs: 004C1116
RtlLengthSid, xrefs: 004C1246
NtTerminateProcess, xrefs: 004C10F6
NtDuplicateToken, xrefs: 004C11F3
RtlAllocateAndInitializeSid, xrefs: 004C120F
ntdll.dll, xrefs: 004C100D
NtSetInformationThread, xrefs: 004C1155
RtlExpandEnvironmentStrings_U, xrefs: 004C10BC
RtlNtStatusToDosError, xrefs: 004C1194
NtSetInformationToken, xrefs: 004C1175
NtQueryInformationToken, xrefs: 004C1262

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: e4d9be6713f9d57c2ef0e63569ad49677bb98de508f22834fc43d2d31264048e
Instruction ID: c668310532dc64a97f5cf1bd553e62826475e492c55dbbed7dbb65cfcc53cadb
Opcode Fuzzy Hash: e4d9be6713f9d57c2ef0e63569ad49677bb98de508f22834fc43d2d31264048e
Instruction Fuzzy Hash: 11513EB9643601A6D7518F69EC64B5637E86749322F1403BB9420D23F1D7F8CA82CB9E

Function 004CB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 004CB2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 004CB2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 004CB2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 004CB2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 004CB31A
GetTimeZoneInformation.KERNEL32(?), ref: 004CB329
wsprintfA.USER32 ref: 004CB3B7

Strings

Nov, xrefs: 004CB29C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 004CB3AF
Mar, xrefs: 004CB264
Apr, xrefs: 004CB26B
May, xrefs: 004CB272
Jan, xrefs: 004CB256
Jul, xrefs: 004CB280
Sep, xrefs: 004CB28E
Dec, xrefs: 004CB2A3
Oct, xrefs: 004CB295
Sat, xrefs: 004CB24F
Aug, xrefs: 004CB287
Wed, xrefs: 004CB23A
Thu, xrefs: 004CB241
Jun, xrefs: 004CB279
Sun, xrefs: 004CB225
Mon, xrefs: 004CB22C
Tue, xrefs: 004CB233
Fri, xrefs: 004CB248
Feb, xrefs: 004CB25D

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 5f8c4e5a4c32ba0287c5a65017c4b7934668f8aec6c7dceb8c964a738ba1c594
Instruction ID: 2de09d58191dca095938e22a9ae72a69589d7d14fe07a32c22f762dde70d8526
Opcode Fuzzy Hash: 5f8c4e5a4c32ba0287c5a65017c4b7934668f8aec6c7dceb8c964a738ba1c594
Instruction Fuzzy Hash: C4519475D1021CAACF58CFD5D859AEEBBB9FF49704F10812BE501B7250D3784A89CB98

Function 004C6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004C654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 004C655C
htonl.WS2_32(?), ref: 004C6578
htonl.WS2_32(?), ref: 004C6587
wsprintfA.USER32 ref: 004C659B
wsprintfA.USER32 ref: 004C65DC
wsprintfA.USER32 ref: 004C6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 004C668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 004C6696
wsprintfA.USER32 ref: 004C66B0
wsprintfA.USER32 ref: 004C66E7
wsprintfA.USER32 ref: 004C66FF
wsprintfA.USER32 ref: 004C671F
ExitProcess.KERNEL32 ref: 004C6755

Strings

localcfg, xrefs: 004C672D
plgs:, xrefs: 004C66AA
va=%08X%08X uef=%p, xrefs: 004C6595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 004C666B
Jan 13 2018, xrefs: 004C653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 004C6547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004C65D6
%d=%p, xrefs: 004C66F9
12:08:32, xrefs: 004C6535
except_info, xrefs: 004C6728

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 81ee6a296748b113edc01b91e8df94f0497196f280d2c8ddea31eb2a2736e0cb
Instruction ID: 08466d0a77727deacca4fce7701f43a19679ceaeb12d9ce4c95e4fcca328044d
Opcode Fuzzy Hash: 81ee6a296748b113edc01b91e8df94f0497196f280d2c8ddea31eb2a2736e0cb
Instruction Fuzzy Hash: B1615E72A50208AFDB609FB4DC45FEA77E9FF08300F24806AF959D3261DA75A9508F54

Function 004CA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004CA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 004CA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 004CA893
wsprintfA.USER32 ref: 004CA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 004CA8D2
wsprintfA.USER32 ref: 004CA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 004CA97C
wsprintfA.USER32 ref: 004CA9B9

Strings

localcfg, xrefs: 004CAB0B
Too small respons, xrefs: 004CA9C9
ehlo %s, xrefs: 004CA7F5
mail from:<%s>, xrefs: 004CA848
Incorrect respons, xrefs: 004CAB39
Error sending command (sent = %d/%d), xrefs: 004CA8A7, 004CA8DA
quit, xrefs: 004CA86C
data, xrefs: 004CA85E
AUTH LOGIN, xrefs: 004CA80C
Too big smtp respons (%d bytes), xrefs: 004CA9B1
rcpt to:<%s>, xrefs: 004CA855
., xrefs: 004CA8CA
helo %s, xrefs: 004CA803
ESMTP, xrefs: 004CAA38

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: b0678bdda8376edec3c28d472ff81923876d6eecc44096ff873ad45b8b10a4bc
Instruction ID: eabfe6d9a3aac16ce7d84e4b66b7844cd59ef61059db42f635da00b5a18d0494
Opcode Fuzzy Hash: b0678bdda8376edec3c28d472ff81923876d6eecc44096ff873ad45b8b10a4bc
Instruction Fuzzy Hash: D9A1067994420DABDFA09A54DC85FAE3769AB0030CF24042FFA01A7290EA3D9D65875F

Function 004C1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004C139A
lstrlenW.KERNEL32(-00000003), ref: 004C1571

Strings

@, xrefs: 004C1380
, xrefs: 004C1462
uac, xrefs: 004C1628
D, xrefs: 004C15C6
%systemroot%\system32\cmd.exe, xrefs: 004C1316
useless, xrefs: 004C161E
wusa.exe, xrefs: 004C1388
PDu, xrefs: 004C139A
<, xrefs: 004C1378

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 75eb81d155013a44510108f1c96a40290daa185f97b8ee31f65580d9439f0e6e
Instruction ID: dd103374a7a69ceaf279e97ca421394ce0be0e8e196f123d699d5ff99724a3ea
Opcode Fuzzy Hash: 75eb81d155013a44510108f1c96a40290daa185f97b8ee31f65580d9439f0e6e
Instruction Fuzzy Hash: D1F19AB92093419FD320DF64C888F6BB7E4FB8A304F10492EF586973A1D7789945CB5A

Function 004C2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 004C2A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 004C2A86
socket.WS2_32(00000002,00000002,00000011), ref: 004C2AA0
htons.WS2_32(00000000), ref: 004C2ADB
select.WS2_32 ref: 004C2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 004C2B4A
htons.WS2_32(?), ref: 004C2B71
htons.WS2_32(?), ref: 004C2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 004C2BFB

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: f51a4e5e2d09b5c9ef50e4bcf79cdc3fba603980c3cf15c51f56a7059582b510
Instruction ID: cafd4fdd25b6662c9d656fa5875774a6e59ef40afaa90cd2ae709f58ff88c70d
Opcode Fuzzy Hash: f51a4e5e2d09b5c9ef50e4bcf79cdc3fba603980c3cf15c51f56a7059582b510
Instruction Fuzzy Hash: CB61ED759053159BC760AF65DE08F2FBBE8FB89744F04081FF84597250D7F998408BAA

Function 004C704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004C70C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 004C719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004C71B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004C7208
RegCloseKey.ADVAPI32(74DF0F10), ref: 004C7291
___ascii_stricmp.LIBCMT ref: 004C72C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004C72D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 004C7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004C73D8

Part of subcall function 004CF1A5: lstrlenA.KERNEL32(000000C8,000000E4,004D22F8,000000C8,004C7150,?), ref: 004CF1AD

Strings

, xrefs: 004C7194
", xrefs: 004C7227

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 6f7eda01279dd9b268d9736154a1aa3d5bdecbf5af0c1483a9bc9c5a2dc0616c
Instruction ID: 94181ce953895b0dc587094da0ad521b5cfeef655ea2ddbf7cfe63569fb6bfe6
Opcode Fuzzy Hash: 6f7eda01279dd9b268d9736154a1aa3d5bdecbf5af0c1483a9bc9c5a2dc0616c
Instruction Fuzzy Hash: 83B18C76908209BBDB559FA1DC45FEF77B8EB04304F10046FF901E2291EB799A84CB68

Function 004CAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004CAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 004CADA6

Part of subcall function 004CAD08: gethostname.WS2_32(?,00000080), ref: 004CAD1C
Part of subcall function 004CAD08: lstrlenA.KERNEL32(00000000), ref: 004CAD60
Part of subcall function 004CAD08: lstrlenA.KERNEL32(00000000), ref: 004CAD69
Part of subcall function 004CAD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 004CAD7F

Part of subcall function 004C30B5: gethostname.WS2_32(?,00000080), ref: 004C30D8
Part of subcall function 004C30B5: gethostbyname.WS2_32(?), ref: 004C30E2

wsprintfA.USER32 ref: 004CAEA5

Part of subcall function 004CA7A3: inet_ntoa.WS2_32(?), ref: 004CA7A9

wsprintfA.USER32 ref: 004CAE4F
wsprintfA.USER32 ref: 004CAE5E

Part of subcall function 004CEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 004CEF92
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(?), ref: 004CEF99
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(00000000), ref: 004CEFA0

Strings

127.0.0.1, xrefs: 004CADEB
%OUTLOOK_HST, xrefs: 004CAEC5
%s%d, xrefs: 004CAE58
%OUTLOOK_BND_, xrefs: 004CAE0F, 004CAE14, 004CAE57, 004CAE76
%OUTLOOK_MID, xrefs: 004CAEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 004CAE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 004CAE49

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 11534b5893d6152d82265e1b6ce003e3d5b569ecf2bead75ea63c533b48218cf
Instruction ID: d234995a2367e4c74b20424874586e35c73d65fa3da11884c17419cef30dd055
Opcode Fuzzy Hash: 11534b5893d6152d82265e1b6ce003e3d5b569ecf2bead75ea63c533b48218cf
Instruction Fuzzy Hash: 644150B690020C6BDB25AFA1DC45FEE3BADFB08304F14442FB91592151EB79E5148B55

Function 004C2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 004C2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E4F
htons.WS2_32(00000035), ref: 004C2E88
inet_addr.WS2_32(?), ref: 004C2E93
gethostbyname.WS2_32(?), ref: 004C2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2EE3
HeapFree.KERNEL32(00000000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2EE6

Strings

GetNetworkParams, xrefs: 004C2E28
iphlpapi.dll, xrefs: 004C2DFB, 004C2E00, 004C2E10

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 53a25f57b9eaada15a50bfcd634d2532699ef92a6b04ef59fc640d39ffb23ba2
Instruction ID: 72f98568f992aba39c0864957b8b1a5a318112836e5b7174996e812825a85be6
Opcode Fuzzy Hash: 53a25f57b9eaada15a50bfcd634d2532699ef92a6b04ef59fc640d39ffb23ba2
Instruction Fuzzy Hash: 4931B139A0120AABDB519BB89D48F6F77B8AF05360F14012BE914F7390DBF8D9418B5C

Function 004C9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C936E
GetModuleFileNameA.KERNEL32(00000000,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C9375
wsprintfA.USER32 ref: 004C93CE
wsprintfA.USER32 ref: 004C940C
wsprintfA.USER32 ref: 004C948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004C94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004C9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004C9571

Strings

runas, xrefs: 004C9674

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: e1a3b1b4c7f3ec3bcfae25919146c658c74a8f5c16e5939fcfb971e43de7c4dc
Instruction ID: 7311013488d10516a1c5206dd7b59cb69d430209e4de0418194247aacd54144e
Opcode Fuzzy Hash: e1a3b1b4c7f3ec3bcfae25919146c658c74a8f5c16e5939fcfb971e43de7c4dc
Instruction Fuzzy Hash: 6BA172B6540248FBEB659FA1CC49FDF37ACEB04744F10402BFA0592291D7B9D944CBA9

Function 004C2011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C2078
GetTickCount.KERNEL32 ref: 004C20D4
GetTickCount.KERNEL32 ref: 004C20DB
GetTickCount.KERNEL32 ref: 004C212B
GetTickCount.KERNEL32 ref: 004C2132
GetTickCount.KERNEL32 ref: 004C2142

Part of subcall function 004CF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,004CE342,00000000,75A8EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4), ref: 004CF089
Part of subcall function 004CF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,004CE342,00000000,75A8EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4,000000C8), ref: 004CF093

Part of subcall function 004CE854: lstrcpyA.KERNEL32(00000001,?,?,004CD8DF,00000001,localcfg,except_info,00100000,004D0264), ref: 004CE88B
Part of subcall function 004CE854: lstrlenA.KERNEL32(00000001,?,004CD8DF,00000001,localcfg,except_info,00100000,004D0264), ref: 004CE899

Part of subcall function 004C1C5F: wsprintfA.USER32 ref: 004C1CE1

Strings

rbl_ip, xrefs: 004C218F
localcfg, xrefs: 004C2070, 004C2160, 004C2186, 004C2194, 004C21E4
net_type, xrefs: 004C21DF
0fN, xrefs: 004C20DD, 004C212D
rbl_bl, xrefs: 004C2181

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0fN$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2898490758
Opcode ID: 1ac6e3ca3ef90700c1a63d797bcd86d3a2ecedb32e722ebbf51f8e06e9b44cab
Instruction ID: ba164521fbb39e679b403e1a679c7fedc73515b9c502e3ac353945dc1393c4ef
Opcode Fuzzy Hash: 1ac6e3ca3ef90700c1a63d797bcd86d3a2ecedb32e722ebbf51f8e06e9b44cab
Instruction Fuzzy Hash: B05103386023465EE7A8EF26EF45F563BD4AB10318F14007FF641862A2DBFC9944CA2D

Function 004CB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004CB467

Part of subcall function 004CEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 004CEF92
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(?), ref: 004CEF99
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(00000000), ref: 004CEFA0

Strings

%s@%s, xrefs: 004CB461
%FROM_DOMAIN, xrefs: 004CB41E
%FROM_USER, xrefs: 004CB431
%TO_EMAIL, xrefs: 004CB473
%FROM_EMAIL, xrefs: 004CB3E9
%M5DATE, xrefs: 004CB50F
%TO_DOMAIN, xrefs: 004CB44B
%TO_HASH, xrefs: 004CB4B0
%P5DATE, xrefs: 004CB4F2
%TO_USER, xrefs: 004CB488
%DATE, xrefs: 004CB4D2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 59d6dae464c533b0920b3faba5b1d4f2b4759ca39b3a802ff08a51f78f94d47f
Instruction ID: 66b3cf7a07a879b751b1d45317002a443ff44938c1de6ac487ae60b17979cc66
Opcode Fuzzy Hash: 59d6dae464c533b0920b3faba5b1d4f2b4759ca39b3a802ff08a51f78f94d47f
Instruction Fuzzy Hash: 46416DB65401187EDF00AAA6CCD2FBF7A6CEE0974CF14011FF904A2142DB78AA1487A9

Function 004CC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004CA4C7: GetTickCount.KERNEL32 ref: 004CA4D1
Part of subcall function 004CA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 004CA4FA

GetTickCount.KERNEL32 ref: 004CC31F
GetTickCount.KERNEL32 ref: 004CC32B
GetTickCount.KERNEL32 ref: 004CC363
GetTickCount.KERNEL32 ref: 004CC378
GetTickCount.KERNEL32 ref: 004CC44D
InterlockedIncrement.KERNEL32(004CC4E4), ref: 004CC4AE
CreateThread.KERNEL32(00000000,00000000,004CB535,00000000,?,004CC4E0), ref: 004CC4C1
CloseHandle.KERNEL32(00000000,?,004CC4E0,004D3588,004C8810), ref: 004CC4CC

Strings

localcfg, xrefs: 004CC2DD

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 24673712623286acfcbdf6ca0c5794be2d09371546d204ffa745a9d5bd90bd3f
Instruction ID: 0307270221df78aa65a2c8fa22fb47d3810731992ae33e9c9830369a8c6df973
Opcode Fuzzy Hash: 24673712623286acfcbdf6ca0c5794be2d09371546d204ffa745a9d5bd90bd3f
Instruction Fuzzy Hash: 15517FB5600B418FC7648F69D5D4A2ABBE9FB48304B50993FD58BC7AA0D778F840CB18

Function 004CBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 004CBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 004CBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 004CBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 004CBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 004CBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 004CBF94

Strings

smtp_retr, xrefs: 004CBE61, 004CBF8C
smtp_herr, xrefs: 004CBE46, 004CBF62
smtp_ban, xrefs: 004CBE55, 004CBF77

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5498af8048b6eeadd8e75fdbaea87334f49fa17848f6a3d483eccb3ab3e64249
Instruction ID: 375ae461effc23fe0266d8897300e21e5e063f1cc95cfdb0309cc60124e10e2c
Opcode Fuzzy Hash: 5498af8048b6eeadd8e75fdbaea87334f49fa17848f6a3d483eccb3ab3e64249
Instruction Fuzzy Hash: 7D51AF39A0021AAFDB518B65CC92FAA7BA9EF14344F14406FE841EB351D738ED418FD8

Function 004C6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6A7D
GetDiskFreeSpaceA.KERNEL32(004C9E9D,004C9A60,?,?,?,004D22F8,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B80
GetLastError.KERNEL32(?,?,?,004C9A60,?,?,004C9E9D,?,?,?,?,?,004C9E9D,?,00000022,?), ref: 004C6B96

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: a98b6ea87bc3c3d02a7a4096429a71d2d1d581941afd43a70c15bc6a92f9e690
Instruction ID: e785920719f576dfc817abc061515c7d7ebdd4431af0d9cc741c8f851401110c
Opcode Fuzzy Hash: a98b6ea87bc3c3d02a7a4096429a71d2d1d581941afd43a70c15bc6a92f9e690
Instruction Fuzzy Hash: AF31CCBA902149BFCB419FA09D44F9FBBB9EB48300F15807BE211E3211E734A9458F69

Function 004C6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,004CD7C3), ref: 004C6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,004CD7C3), ref: 004C6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 004C6FE8
LocalFree.KERNEL32(00000120), ref: 004C701F
wsprintfA.USER32 ref: 004C7036

Strings

|, xrefs: 004C6FB3
/%d, xrefs: 004C7030

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 5a62fd4339008a46d58338b8b3f069d9a79bfb2481d357156310e134b7a7af95
Instruction ID: d01f510a59c8f45e097c839cb921dcd85adc8b2650f002ccb7acdd7ee33cbdf2
Opcode Fuzzy Hash: 5a62fd4339008a46d58338b8b3f069d9a79bfb2481d357156310e134b7a7af95
Instruction Fuzzy Hash: BE312B76500108BBDB41DFA5D845FDF7BA8AF04314F04806BF909DB201DA39DA088B98

Function 004C6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004D22F8,000000E4,004C6DDC,000000C8), ref: 004C6CE7
GetProcAddress.KERNEL32(00000000), ref: 004C6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 004C6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 004C6D2B

Strings

C:\Windows\SysWOW64\, xrefs: 004C6CC9, 004C6CD1, 004C6CFE, 004C6D05, 004C6D13, 004C6D1E, 004C6D2A, 004C6D42, 004C6D5F, 004C6D85
GetSystemWow64DirectoryA, xrefs: 004C6CDD
kernel32, xrefs: 004C6CE2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: f34a5e8cd58c80fc604d1d63b3fb1e925c67e6b4f3df8dd071588d31f63b270a
Instruction ID: 3c1e64b19c1349cd0c32d010e5e3644bd47baa15138df500ae4be634476dab03
Opcode Fuzzy Hash: f34a5e8cd58c80fc604d1d63b3fb1e925c67e6b4f3df8dd071588d31f63b270a
Instruction Fuzzy Hash: 4C21355974224039F7A257325E89F7B2F4C8B62744F0D809FF805A72D2CBDD884682AD

Function 004C977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,004C9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004D22F8), ref: 004C97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004D22F8), ref: 004C97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C985B

Strings

D, xrefs: 004C97A9

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: f9dd04d3d9bba895192258002e4ea206a85955bff8225d0d483fcfea03a1b6b5
Instruction ID: 868e3742da55ae1e2ce7244975336ec824f35d3d402753958b4023b2093b80be
Opcode Fuzzy Hash: f9dd04d3d9bba895192258002e4ea206a85955bff8225d0d483fcfea03a1b6b5
Instruction Fuzzy Hash: FD216D75902129BBDB519FA1DC49FEF7BBCEF05750F400066B909E2150EB359A44CAA8

Function 004CE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

Part of subcall function 004CDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 004CDDB5

lstrcpynA.KERNEL32(?,004C1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,004CEAAA,?,?), ref: 004CE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?), ref: 004CE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?,0000000A), ref: 004CE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?), ref: 004CE94F

Strings

localcfg, xrefs: 004CE8AB
flags_upd, xrefs: 004CE8A7

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 0908d74fd094aae1d177ca834c77e48acc8e79906dfef2abc39900dec8f7a2d6
Instruction ID: bb547afcfde0830d9b25f30e6d4cb05e5d00098b0b24688b7fa71bdba7b654c8
Opcode Fuzzy Hash: 0908d74fd094aae1d177ca834c77e48acc8e79906dfef2abc39900dec8f7a2d6
Instruction Fuzzy Hash: DC515076D00209AFCB41EFA9C984EAEB7F9FF44308F14052EE405A3211DB79EA149B54

Function 004C6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 004C6BB2

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 2fd00c2e03f3e75cd24c459dc7e542139a5314c5681fa91e36d8f5d7a1c43d8f
Instruction ID: 1a8869f5b927290ae55461d461d765f726292612f262ae8e2f6dfb17d58003ab
Opcode Fuzzy Hash: 2fd00c2e03f3e75cd24c459dc7e542139a5314c5681fa91e36d8f5d7a1c43d8f
Instruction Fuzzy Hash: 7C21A17A101115FFDB525B61FD49FAF3BACDB04364B21842BF502E2051EB38DA00967C

Function 004C9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004D22F8), ref: 004C907B
wsprintfA.USER32 ref: 004C90E9
CreateFileA.KERNEL32(004D22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004C910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 004C9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 004C912D
CloseHandle.KERNEL32(00000000), ref: 004C9134

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 64c8c5a500366e8dc7622b98f4d76957bbfbf1ca69a40a5be735d5a62ab6586c
Instruction ID: 9e3e3016c07ae1bce3abf8e7130bfff429177fd496e2378394487b6620b8ccc7
Opcode Fuzzy Hash: 64c8c5a500366e8dc7622b98f4d76957bbfbf1ca69a40a5be735d5a62ab6586c
Instruction Fuzzy Hash: EF1184B66411147BF7656B23EC0EFAF366DDBC5B04F00807FBB0AA6191EA744E019668

Function 004CDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CDD0F
GetCurrentThreadId.KERNEL32 ref: 004CDD20
GetTickCount.KERNEL32 ref: 004CDD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,004CE538,?,74DF0F10,?,00000000,?,004CA445), ref: 004CDD3B
InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
GetCurrentThreadId.KERNEL32 ref: 004CDD53

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: bc05a9d8b0d5ef1a396ad13fbaacd0a08f61bc1b80268cee19e9782d779e078d
Instruction ID: fafcfb2850569b7640972b914535e4d0e25ebde81a3780c7489f584e70542231
Opcode Fuzzy Hash: bc05a9d8b0d5ef1a396ad13fbaacd0a08f61bc1b80268cee19e9782d779e078d
Instruction Fuzzy Hash: 97F0BE76906204BBD7915F65BC84F293BA4E744312F00007BE20AC3260C7289545CE2F

Function 004CAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004CAD1C
lstrlenA.KERNEL32(00000000), ref: 004CAD60
lstrlenA.KERNEL32(00000000), ref: 004CAD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 004CAD7F

Strings

LocalHost, xrefs: 004CAD79

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 1b3f385fa85f30b4f5aaecae4eb5b84f49e297ac8b8deed8ceaf5b290ec28de6
Instruction ID: 719388dcd45ccf5874f294a38e04469f923d9ecf067f55b3889910d0af465ac9
Opcode Fuzzy Hash: 1b3f385fa85f30b4f5aaecae4eb5b84f49e297ac8b8deed8ceaf5b290ec28de6
Instruction Fuzzy Hash: BF01492C84418D5DDFB206289844FA63F779B9770EF10005FE4C2C7616D61C8853835F

Function 004C4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C4290
CloseHandle.KERNEL32(004CA3C7), ref: 004C43AB
CloseHandle.KERNEL32(00000001), ref: 004C43AE

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: f0e4d0c38b3c2bdfffdbba55ef22ce55060f70a4e0bb16f71e74e709b1391079
Instruction ID: ff6964a2d6be4fa81cb16f4f8f8f257047f809d2014470a055174496efe34d94
Opcode Fuzzy Hash: f0e4d0c38b3c2bdfffdbba55ef22ce55060f70a4e0bb16f71e74e709b1391079
Instruction Fuzzy Hash: 02418375D00109BADB10AFA2CD46FEF7FB8EF80325F10455EF514A2191D7389A41DB64

Function 004C6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004C64CF,00000000), ref: 004C609C
LoadLibraryA.KERNEL32(?,?,004C64CF,00000000), ref: 004C60C3
GetProcAddress.KERNEL32(?,00000014), ref: 004C614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 004C619E

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: a128973405898bae28d53bc5d0b19d2051d9e7f9025a27c2e81c5989a9474e4f
Instruction ID: e1d06ea70e973f5749cfa4e4386d6f8f31e1d9a6905ae892c542539093dc67fe
Opcode Fuzzy Hash: a128973405898bae28d53bc5d0b19d2051d9e7f9025a27c2e81c5989a9474e4f
Instruction Fuzzy Hash: D0418979A00106ABDB50CF59C880F6AB7B8EF04355F2AC06EE815D7391EB38ED41CB84

Function 004C2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915389caf191f4b927dbb499c0a1a4a58cbdbcad14b903b848c3218b190806cb
Instruction ID: b7b9f3a2ddcaad29d53cf7e0cf2c803e65e96e41b2114025743b39d289a67857
Opcode Fuzzy Hash: 915389caf191f4b927dbb499c0a1a4a58cbdbcad14b903b848c3218b190806cb
Instruction Fuzzy Hash: FB31BF79A00619ABCB509FA6CD81BBEB7F4FF48705F10446FE504E7241E3B8DA418B68

Function 004C26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C272E
htons.WS2_32(00000001), ref: 004C2752
htons.WS2_32(0000000F), ref: 004C27D5
htons.WS2_32(00000001), ref: 004C27E3
sendto.WS2_32(?,004D2BF8,00000009,00000000,00000010,00000010), ref: 004C2802

Part of subcall function 004CEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
Part of subcall function 004CEBCC: RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 4815b5e8a4fc83553270df3f8c82d4be42b37ce66466dd1b51c4f8b62bc2ad43
Instruction ID: 47f37b8ba99dd51fb327272efef48c8fbce319c463e1ee92302f727ed2eae893
Opcode Fuzzy Hash: 4815b5e8a4fc83553270df3f8c82d4be42b37ce66466dd1b51c4f8b62bc2ad43
Instruction Fuzzy Hash: FB3104382823829FD7108F74D990E667760BF29318B19806FE8558B322D6F7E842D718

Function 004C9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004D22F8), ref: 004C915F
GetModuleFileNameA.KERNEL32(00000000), ref: 004C9166
CharToOemA.USER32(?,?), ref: 004C9174
wsprintfA.USER32 ref: 004C91A9

Part of subcall function 004C9064: GetTempPathA.KERNEL32(00000400,?,00000000,004D22F8), ref: 004C907B
Part of subcall function 004C9064: wsprintfA.USER32 ref: 004C90E9
Part of subcall function 004C9064: CreateFileA.KERNEL32(004D22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004C910E
Part of subcall function 004C9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 004C9122
Part of subcall function 004C9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 004C912D
Part of subcall function 004C9064: CloseHandle.KERNEL32(00000000), ref: 004C9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004C91E1

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 61dd2dfb0d27c6cf5bfdcc0e8ed2b52b9fc8d5f41dec7d9f3c194100cf53e6a0
Instruction ID: bbda71737a33205aba49252010a3e06eceab56714e82e6d61c84ba5d34d4fd65
Opcode Fuzzy Hash: 61dd2dfb0d27c6cf5bfdcc0e8ed2b52b9fc8d5f41dec7d9f3c194100cf53e6a0
Instruction Fuzzy Hash: 890152FA9401187BD760A7629D4DFDF777CDB95B05F0000A7B749E2040DAB49A858F74

Function 004C2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001), ref: 004C2429
lstrlenA.KERNEL32(?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001,004C1E3D,00000001,localcfg,lid_file_upd), ref: 004C243E
lstrcmpiA.KERNEL32(?,?), ref: 004C2452
lstrlenA.KERNEL32(?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001,004C1E3D,00000001,localcfg,lid_file_upd), ref: 004C2467

Strings

localcfg, xrefs: 004C241F

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: fdb7e888ffc0f2c163271c89e52a2f6db6ffeb1d1b4a651a09c81b7c5b2e48d9
Instruction ID: 02d82fdf9c30a396887b112e9b028dc421f46b1408ab3955e29f86bff0103575
Opcode Fuzzy Hash: fdb7e888ffc0f2c163271c89e52a2f6db6ffeb1d1b4a651a09c81b7c5b2e48d9
Instruction Fuzzy Hash: F3011A35600218BFCF55EF69DD80ADE7BA9EF44354B01C42AE85997210E3B4EA40CA98

Function 004C6EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004C6F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pL), ref: 004C6F24
FreeSid.ADVAPI32(?), ref: 004C6F3E

Strings

*pL, xrefs: 004C6F1C, 004C6F1F

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pL
API String ID: 3429775523-2597219945
Opcode ID: a8eb5ac75762d3d4ee7ec6705a97b516a73bd85534136a7b194bc7f13267106c
Instruction ID: 2d6165f0756935f7d3e00eaf91cb47c33ddc6e682fbd10dc80b053c5d5a7d696
Opcode Fuzzy Hash: a8eb5ac75762d3d4ee7ec6705a97b516a73bd85534136a7b194bc7f13267106c
Instruction Fuzzy Hash: C8011E75901208BFDB11DFE4ED85FAE77B8EB04304F10887FE605E2151E7749944CA18

Function 004C1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004C1CE1
wsprintfA.USER32 ref: 004C1D6B

Strings

localcfg, xrefs: 004C1C70
%u.%u.%u.%u.%s, xrefs: 004C1CDB, 004C1D65

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 7aa2cff6518119168288f3ed4639d535f9ed52aff59db381a5b01edf89d19578
Instruction ID: 84b5394328a2147331d24bc0815d11a2c9abd36bad3f2e07c29c5e4be4830962
Opcode Fuzzy Hash: 7aa2cff6518119168288f3ed4639d535f9ed52aff59db381a5b01edf89d19578
Instruction Fuzzy Hash: D241DF369002989FDB61CF798C44FEE3BE89F0A310F24005AFD60D3252D638EA04CBA4

Function 004CE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,004C5EC1), ref: 004CE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,004C5EC1), ref: 004CE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,004C5EC1), ref: 004CE722

Strings

89ABCDEF, xrefs: 004CE721

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: d3efcb5e32f33bcc5e0866d339d7c1cc3695e8c6d36f8e5d60e310e4b992dd45
Instruction ID: 7371dad12bb96de9a93684eb0878a53b2e465794217836d885e7b4e340719145
Opcode Fuzzy Hash: d3efcb5e32f33bcc5e0866d339d7c1cc3695e8c6d36f8e5d60e310e4b992dd45
Instruction Fuzzy Hash: 1A31EF39A11302DBCBB18F66D884F6B37E4AB20324F10843FE55687650E778EC80CB89

Function 004CE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,004CE2A3,00000000,00000000,00000000,00020106,00000000,004CE2A3,00000000,000000E4), ref: 004CE0B2
RegSetValueExA.ADVAPI32(004CE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004D22F8), ref: 004CE127
RegDeleteValueA.ADVAPI32(004CE2A3,?,?,?,?,?,000000C8,004D22F8), ref: 004CE158
RegCloseKey.ADVAPI32(004CE2A3,?,?,?,?,000000C8,004D22F8,?,?,?,?,?,?,?,?,004CE2A3), ref: 004CE161

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 646352c0c9f16613d89c48ceb7a7231b42a5116f7d3a4a47f93f18a21d0bcaa9
Instruction ID: c8971767fb2ac80ca570c2cc04d4c6e26a28a397b76bbd8867e9f4c2389cfb9f
Opcode Fuzzy Hash: 646352c0c9f16613d89c48ceb7a7231b42a5116f7d3a4a47f93f18a21d0bcaa9
Instruction Fuzzy Hash: B7219C31A00229BBDF619EA6DC89F9F7FB9EF08754F044066F904A2150EB718A14CB94

Function 004C3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,004CA3C7,00000000,00000000,000007D0,00000001), ref: 004C3F44
GetLastError.KERNEL32 ref: 004C3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 004C3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3F72

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 7a7d4cb4c2b78da3e2cad14a4442e24face8452b64840a07d6d72b2a5d288852
Instruction ID: fdc26bc39bfaa050d4059eb576baa465bec8c8854f790b0a682aa93603373568
Opcode Fuzzy Hash: 7a7d4cb4c2b78da3e2cad14a4442e24face8452b64840a07d6d72b2a5d288852
Instruction Fuzzy Hash: 4901E972912109ABDF01DF90ED44BEF7B7CEB04356F10842AFA01E2150D734DA158BBA

Function 004C3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,004CA3C7,00000000,00000000,000007D0,00000001), ref: 004C3FB8
GetLastError.KERNEL32 ref: 004C3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 004C3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3FE6

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 37c45f92fd704ab3fc4a43c7547d35be97bada8aaa74c108725e66dc2211e3a5
Instruction ID: afd497f02c37896304344ead73dce5717c4bf5cbf805c1f54f41b6d096187b43
Opcode Fuzzy Hash: 37c45f92fd704ab3fc4a43c7547d35be97bada8aaa74c108725e66dc2211e3a5
Instruction Fuzzy Hash: 2901297291110AABDF01DF94ED45BEF3BBCEB08356F00842AF902E2050D734DA148BBA

Function 004CA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CA4D1
GetTickCount.KERNEL32 ref: 004CA4E4
Sleep.KERNEL32(00000000,?,004CC2E9,004CC4E0,00000000,localcfg,?,004CC4E0,004D3588,004C8810), ref: 004CA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 004CA4FA

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 0db20d39e1b77d56c2e2d9d4613632640ee4744cdf128cca5b8473f7a4df5c53
Instruction ID: cf3f0bd912c0a20699f70d5dedefc067b740095c997432aeccba6528d9992e7c
Opcode Fuzzy Hash: 0db20d39e1b77d56c2e2d9d4613632640ee4744cdf128cca5b8473f7a4df5c53
Instruction Fuzzy Hash: FBE0263B20220877C7001BA5BD84F6A7388AB4A761F054037FB04D3240C65AA85141BF

Function 004C4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C4E9E
GetTickCount.KERNEL32 ref: 004C4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 004C4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 004C4EC3

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 359984679506c8b9bd00185a2f69d818ca4672a8c03de0e52069ed0232604487
Instruction ID: fe899e51c986c14b6a337e72d8100cd25e863c1add3c6f776be22d26ee618213
Opcode Fuzzy Hash: 359984679506c8b9bd00185a2f69d818ca4672a8c03de0e52069ed0232604487
Instruction Fuzzy Hash: 1AE0863A20221467D61027B9BE84F5A6799AB96361F060537E709D3180C65A984245B9

Function 004C4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C4BDD
GetTickCount.KERNEL32 ref: 004C4BEC
Sleep.KERNEL32(00000000,?,?,?,02A1B1BC,004C50F2), ref: 004C4BF9
InterlockedExchange.KERNEL32(02A1B1B0,00000001), ref: 004C4C02

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 24c3059b018bc6c89f0506260fcf988047c5eced751e5673ee5a22bdbe4ddcd8
Instruction ID: 74c0b1106b67a8a95e34c2d611ca30b86a70f0da469873470ab45fb8748f94df
Opcode Fuzzy Hash: 24c3059b018bc6c89f0506260fcf988047c5eced751e5673ee5a22bdbe4ddcd8
Instruction Fuzzy Hash: 08E0863A24221467D75017A57E80F5A77989B96361F060077F708D3150D95AE84141B9

Function 004C30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C3103
GetTickCount.KERNEL32 ref: 004C310F
Sleep.KERNEL32(00000000), ref: 004C311C
InterlockedExchange.KERNEL32(?,00000001), ref: 004C3128

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e7d2dca63d41372aaf467d57ca0b581995c49d734370837b42f90053a575c2e0
Instruction ID: d4df164f5b3d0751408e536eb6e67bf0107015de6418ce1592e3efe539ac51f6
Opcode Fuzzy Hash: e7d2dca63d41372aaf467d57ca0b581995c49d734370837b42f90053a575c2e0
Instruction Fuzzy Hash: 9FE0C239201215BFDB406F75BE44F5A6B9ADF84762F05403BF201D31A0C9554D01897A

Function 004C6987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(004C9A60,?,?,00000000,00000000,004C9A60,?,00000000), ref: 004C69F9
WriteFile.KERNEL32(004C9A60,?,004C9A60,00000000,00000000), ref: 004C6A27

Strings

,kL, xrefs: 004C69A7, 004C69D5

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kL
API String ID: 3934441357-930470209
Opcode ID: 4a67c524b8be7eda31fe68ce1e04b5a9f9dc7b886f165af050711f4b67bd9f18
Instruction ID: 1eaab636ce026711230c417406459cd0320d98ec8d0446c1d56b1ebb42c85878
Opcode Fuzzy Hash: 4a67c524b8be7eda31fe68ce1e04b5a9f9dc7b886f165af050711f4b67bd9f18
Instruction Fuzzy Hash: 6F313676A00209EFDB64CF69D984FAAB7F4EB04315F12846EE801E7200D375EE54CBA5

Function 004C8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C8D02
GetTickCount.KERNEL32 ref: 004C8DA1

Strings

localcfg, xrefs: 004C8D19

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 9a62ea1a0e63c7b18cc9a37d65d196c193d1fd21ef490ad41bc16e943ef0a8b5
Instruction ID: ebff12fdd3d3671089170fba5c940ccc2c349161b095f7f037a0f1aef549ea77
Opcode Fuzzy Hash: 9a62ea1a0e63c7b18cc9a37d65d196c193d1fd21ef490ad41bc16e943ef0a8b5
Instruction Fuzzy Hash: 4721C03A611215AFCB908F64DD85F9ABBB9EB21315B29006FD802D7291CF38E940C75A

Function 004CBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CBFD0
wsprintfA.USER32 ref: 004CC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 004CC057

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 6d4175e935614c6513606c3b1149b6062c895b6f419c232884d724964a263483
Instruction ID: e1e08c355069369b10b68beb97e05226ce8fecbe86ca5c9c1a6733d483204003
Opcode Fuzzy Hash: 6d4175e935614c6513606c3b1149b6062c895b6f419c232884d724964a263483
Instruction Fuzzy Hash: B5119772100100FFDB429BA9DD44E567FA6FF88318B3481ADF6188E166D633D863EB50

Function 004C38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004C30FA: GetTickCount.KERNEL32 ref: 004C3103
Part of subcall function 004C30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 004C3128

GetCurrentThreadId.KERNEL32 ref: 004C3929
GetCurrentThreadId.KERNEL32 ref: 004C3939

Strings

%FROM_EMAIL, xrefs: 004C3913

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 6c6bc35a13817fedbc31e50f2360238e96e0ff1dc8d8b2c62a22c91371489de9
Instruction ID: fec4b45eeb4c2abd2d77d790885c7b1682ae6160d866a753373832113c761bf4
Opcode Fuzzy Hash: 6c6bc35a13817fedbc31e50f2360238e96e0ff1dc8d8b2c62a22c91371489de9
Instruction Fuzzy Hash: AF1104B9900214EBD760DF1AD581B69F3F4FB09716F10856FE84497291C7B8AA80CFA9

Function 004CAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,004CBD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 004CABB9
InterlockedIncrement.KERNEL32(004D3640), ref: 004CABE1

Strings

%FROM_EMAIL, xrefs: 004CAB8C

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 8537b946b450c9db1de0ccd7afe2f1f6fd9eb928b6ee09c107edcc650c484ae3
Instruction ID: 51245cf27a3111cb429c8a0c49fa3e8c2bd7059e7d14b82d54964c0e9711931e
Opcode Fuzzy Hash: 8537b946b450c9db1de0ccd7afe2f1f6fd9eb928b6ee09c107edcc650c484ae3
Instruction Fuzzy Hash: 4D019E35508288AFDB21CF18D881F967BA6AF15318F14449AE6808B353C379EA55CB96

Function 004C26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004C26C3
inet_ntoa.WS2_32(?), ref: 004C26E4

Strings

localcfg, xrefs: 004C26CD, 004C26D2, 004C26DE

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 0d2e0d28fb9510006f9952e94c7ec37c3dff983b682081276bd165da9e02934f
Instruction ID: 5e791386e0305f630fd5c8f216f1528c3f33e126128692a2cd480b98aa458bb2
Opcode Fuzzy Hash: 0d2e0d28fb9510006f9952e94c7ec37c3dff983b682081276bd165da9e02934f
Instruction Fuzzy Hash: 3BF082362492097BEF406FA5ED09F9A379CEB04350F10446FFA08CA090DBB5D94097AC

Function 004C9961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(jjcfhqgg,Function_00009867), ref: 004C996C

Part of subcall function 004C9892: SetServiceStatus.ADVAPI32(004D3394), ref: 004C98EB

Part of subcall function 004C98F2: Sleep.KERNEL32(000003E8,00000100,004D22F8,004CA3C7), ref: 004C9909

Strings

hK, xrefs: 004C9974, 004C99BA
jjcfhqgg, xrefs: 004C9967, 004C99AD

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Service$CtrlHandlerRegisterSleepStatus
String ID: hK$jjcfhqgg
API String ID: 1317371667-1757453468
Opcode ID: 93ad6211244068cc4d1f880d85e3c43e2474dca98f498cd923d1352cff8b6984
Instruction ID: 76596864d37334dacfc07713d6100aff2f25d586b2b2101334ab3df28ba40efc
Opcode Fuzzy Hash: 93ad6211244068cc4d1f880d85e3c43e2474dca98f498cd923d1352cff8b6984
Instruction Fuzzy Hash: 3CF030E5542244BEE7506F516E8FF123248A711749F04003FB9054A291EBB94D04823B

Function 004CEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,004CEB54,_alldiv,004CF0B7,80000001,00000000,00989680,00000000,?,?,?,004CE342,00000000,75A8EA50,80000001,00000000), ref: 004CEAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 004CEB07

Strings

ntdll.dll, xrefs: 004CEAED

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 89b299af721506dc1f0d78a70672c4250cd5715899f5e76e98a22ec05fe61714
Instruction ID: 87e2e503f6f3d79facb94c37c6303aa03000d7657880c4d13eeea2ef5d8c6a2a
Opcode Fuzzy Hash: 89b299af721506dc1f0d78a70672c4250cd5715899f5e76e98a22ec05fe61714
Instruction Fuzzy Hash: 2BD0C978602702BB8F62DF65AD1AF1A77A8EB50702F40803BB416C2620E738E844DA0D

Function 004C2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004C2D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,004C2F01,?,004C20FF,004D2000), ref: 004C2D3A
Part of subcall function 004C2D21: LoadLibraryA.KERNEL32(?), ref: 004C2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004C2F73
HeapFree.KERNEL32(00000000), ref: 004C2F7A

Memory Dump Source

Source File: 00000011.00000002.2902905763.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: db36e5989226fe336c3157799c4d9089149d03af0495fa0a30321beea1d59dd9
Instruction ID: 90d3cf73005c3ba09812ea3a25123deed985ed59325a2a6925c4eaed2b346203
Opcode Fuzzy Hash: db36e5989226fe336c3157799c4d9089149d03af0495fa0a30321beea1d59dd9
Instruction Fuzzy Hash: BA51C27A90020A9FCF01DF64D884AFAB775FF16304F14416EEC96C7210E7769A19CB88

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report I5vhb7vJPS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\wzsddmnn.exe

C:\Windows\SysWOW64\jjcfhqgg\wzsddmnn.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
I5vhb7vJPS.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre