Edit tour

Windows Analysis Report
BqDa1EBEUK.exe

Overview

General Information

Sample name:	BqDa1EBEUK.exe renamed because original name is a hash value
Original sample name:	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Analysis ID:	1465369
MD5:	aa9d475bc02429a35578c7c7495391c0
SHA1:	aefabfe061db6b6013e842c1ff5afb09b5686a6a
SHA256:	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

BqDa1EBEUK.exe (PID: 5680 cmdline: "C:\Users\user\Desktop\BqDa1EBEUK.exe" MD5: AA9D475BC02429A35578C7C7495391C0)

conhost.exe (PID: 3636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6444 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.196.9.26:6302", "Bot Id": "\u0295J", "Authorization Header": "4c4c925477423905413bca8818103116"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: BqDa1EBEUK.exe PID: 5680	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6444	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.BqDa1EBEUK.exe.6ccff000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BqDa1EBEUK.exe.6ccff000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BqDa1EBEUK.exe.6cce0000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 185.196.9.26

Timestamp:	07/01/24-15:43:58.016995
SID:	2046045
Source Port:	49705
Destination Port:	6302
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 185.196.9.26

Timestamp:	07/01/24-15:44:06.078345
SID:	2043231
Source Port:	49705
Destination Port:	6302
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 185.196.9.26 - Destination IP: 192.168.2.5

Timestamp:	07/01/24-15:43:58.383566
SID:	2043234
Source Port:	6302
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 185.196.9.26 - Destination IP: 192.168.2.5

Timestamp:	07/01/24-15:44:03.740669
SID:	2046056
Source Port:	6302
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "185.196.9.26:6302", "Bot Id": "\u0295J", "Authorization Header": "4c4c925477423905413bca8818103116"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: BqDa1EBEUK.exe

ReversingLabs: Detection: 64%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BqDa1EBEUK.exe

Joe Sandbox ML: detected

Source: BqDa1EBEUK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BqDa1EBEUK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCF0A98 FindFirstFileExW,

0_2_6CCF0A98

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05B4D753h	2_2_05B4D490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05B4FB58h	2_2_05B4F660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_05B48398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05B4D247h	2_2_05B4CAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	2_2_05B424F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05B4AB43h	2_2_05B4AB2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 071BFFB5h	2_2_071BFBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 071BFFB5h	2_2_071BFBE8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49705 -> 185.196.9.26:6302
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49705 -> 185.196.9.26:6302
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 185.196.9.26:6302 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 185.196.9.26:6302 -> 192.168.2.5:49705

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.196.9.26:6302

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 185.196.9.26:6302

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26

Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BqDa1EBEUK.exe, BqDa1EBEUK.exe, 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCE2790 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,

0_2_6CCE2790

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCE11E0	0_2_6CCE11E0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCE2790	0_2_6CCE2790
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCE2F70	0_2_6CCE2F70
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCF7045	0_2_6CCF7045
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCEB450	0_2_6CCEB450
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCE2C00	0_2_6CCE2C00
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCE1000	0_2_6CCE1000
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A910B0	0_2_00A910B0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9E2A0	0_2_00A9E2A0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9B299	0_2_00A9B299
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9CBEF	0_2_00A9CBEF
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A98C80	0_2_00A98C80
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9A4F0	0_2_00A9A4F0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A98E10	0_2_00A98E10
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9B0F0	0_2_00A9B0F0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9F878	0_2_00A9F878
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9ABB0	0_2_00A9ABB0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A98C50	0_2_00A98C50
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A98C50	0_2_00A98C50
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9F5A0	0_2_00A9F5A0
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A98DFF	0_2_00A98DFF
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A99530	0_2_00A99530
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_00A9EE53	0_2_00A9EE53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_012CDC74	2_2_012CDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49498	2_2_05B49498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4B780	2_2_05B4B780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4F660	2_2_05B4F660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4C118	2_2_05B4C118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B46090	2_2_05B46090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49030	2_2_05B49030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B48398	2_2_05B48398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4B218	2_2_05B4B218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4A240	2_2_05B4A240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4DED0	2_2_05B4DED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B47B28	2_2_05B47B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4CAE8	2_2_05B4CAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49AD8	2_2_05B49AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49488	2_2_05B49488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B45478	2_2_05B45478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B457C0	2_2_05B457C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B40710	2_2_05B40710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B40700	2_2_05B40700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49020	2_2_05B49020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B48388	2_2_05B48388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4B208	2_2_05B4B208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B49AC7	2_2_05B49AC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071B7748	2_2_071B7748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071B2638	2_2_071B2638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BB4A0	2_2_071BB4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BEE28	2_2_071BEE28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BB948	2_2_071BB948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071B18F0	2_2_071B18F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BF333	2_2_071BF333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BF340	2_2_071BF340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BFBD8	2_2_071BFBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BFBE8	2_2_071BFBE8

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: String function: 6CCEC5B0 appears 33 times

Source: BqDa1EBEUK.exe, 00000000.00000000.2140738408.00000000001FC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNovaEdge45545279545.exeT vs BqDa1EBEUK.exe
Source: BqDa1EBEUK.exe, 00000000.00000002.2144156974.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs BqDa1EBEUK.exe
Source: BqDa1EBEUK.exe, 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameLeve.exe8 vs BqDa1EBEUK.exe
Source: BqDa1EBEUK.exe	Binary or memory string: OriginalFilenameNovaEdge45545279545.exeT vs BqDa1EBEUK.exe

Source: BqDa1EBEUK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BqDa1EBEUK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03

Source: BqDa1EBEUK.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2254089575.0000000003617000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE offer_meLReq$;a

Source: BqDa1EBEUK.exe

ReversingLabs: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\BqDa1EBEUK.exe "C:\Users\user\Desktop\BqDa1EBEUK.exe"
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32

Jump to behavior

Source: BqDa1EBEUK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BqDa1EBEUK.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: BqDa1EBEUK.exe

Static file information: File size 1610240 > 1048576

Source: BqDa1EBEUK.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x14b200

Source: BqDa1EBEUK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: BqDa1EBEUK.exe

Static PE information: section name: .uk8

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCF7774 push ecx; ret	0_2_6CCF7787
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BD522 pushad ; retn 6B9Ah	2_2_071BD58D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BB31C push FFFFFF8Bh; iretd	2_2_071BB31E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_071BB361 push FFFFFF8Bh; iretd	2_2_071BB363

Source: BqDa1EBEUK.exe

Static PE information: section name: .text entropy: 7.892081010693948

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory allocated: 23A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 579			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1468			Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe TID: 7128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1772	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5844	Thread sleep count: 579 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5844	Thread sleep count: 1468 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6540	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCF0A98 FindFirstFileExW,

0_2_6CCF0A98

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000033C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LReq
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2252915407.00000000013A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: MSBuild.exe, 00000002.00000002.2257843372.0000000004319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000002.00000002.2254089575.00000000034A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_05B47410 LdrInitializeThunk,

2_2_05B47410

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCEC43A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CCEC43A

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCF21BB GetProcessHeap,

0_2_6CCF21BB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCEC43A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCEC43A
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCF03E7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCF03E7
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Code function: 0_2_6CCEBF61 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CCEBF61

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCE2F70 HonorInc,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,CreateProcessW,VirtualAlloc,GetThreadContext,VirtualAllocEx,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,

0_2_6CCE2F70

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: DE3008	Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCEC5F8 cpuid

0_2_6CCEC5F8

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe	Queries volume information: C:\Users\user\Desktop\BqDa1EBEUK.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BqDa1EBEUK.exe

Code function: 0_2_6CCEC083 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CCEC083

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2262970296.0000000005A77000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6ccff000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6ccff000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6cce0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BqDa1EBEUK.exe PID: 5680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6444, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6444, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6ccff000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6ccff000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BqDa1EBEUK.exe.6cce0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BqDa1EBEUK.exe PID: 5680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	351 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BqDa1EBEUK.exe	65%	ReversingLabs	Win32.Trojan.RedLine
BqDa1EBEUK.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\d3d9.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\d3d9.dll	92%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
185.196.9.26:6302	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtabS	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Response	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.196.9.26:6302	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	BqDa1EBEUK.exe, BqDa1EBEUK.exe, 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000002.00000002.2254089575.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtabS	MSBuild.exe, 00000002.00000002.2254089575.0000000003730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	MSBuild.exe, 00000002.00000002.2254089575.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2254089575.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	MSBuild.exe, 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.26	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465369
Start date and time:	2024-07-01 15:42:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BqDa1EBEUK.exe renamed because original name is a hash value
Original Sample Name:	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 44 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 2.16.100.168, 88.221.110.91, 192.229.221.95, 52.165.164.15
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: BqDa1EBEUK.exe

Simulations

Behavior and APIs

Time	Type	Description
09:44:03	API Interceptor	13x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.9.26	software.exe	Get hash	malicious	RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://www.asarco.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://m.exactag.com/ai.aspx?tc=d9288846bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ainjurylawkings.com%2Fwinner%2F13476%2F%2Fc2FuZWV5YS5rYW5nQDJzZmcuY29t	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	192.229.221.95
	https://na4.docusign.net/Signing/EmailStart.aspx?a=95fa3666-e4d2-4181-926f-7d752b5d1bb7&acct=4b225f64-a250-4de3-9bb5-6320c76f2c33&er=388f7591-fe27-446f-8df0-11aebdd778b2	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://skofmygytomybosinthrfm.nl/you/hi/okay/okay/their/kkyag/than/to/us/us/invite/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://links.notification.intuit.com/ls/click?upn=u001.4HBRtPy8j6uXsK2aeX2RzAh5EFPhCIIFV3VEN-2Fx7CtL7yL0rqbEG5To4Yn7gWqQ9aLy0xQjXtfA1aWI51jOBcgZZmdPU7rNXiI9qBQrw0Fh0XMUzwxEuUgv3ZFNQWIem-2BNTPYnrL9k9a1nDRjz4a88WPYyDduqTuKohuiQXsusYwJ-2FidZWWf8oC-2Bke5XZf6maHD-2Fd7ablYFhYAopCg9-2FJ24-2F8yZwA220wlNNRUX0yppVttR34V4P26behAEAgmPnWgi1QdqkcH8GVovfzu4LIw-3D-3DQBy7_5Y9C-2B-2Fzbmi1Z8AZ1P0Xb45Ep-2FzkkH96c1HQoTeKyfF3Cy9GA0JrKF-2FtBKU7Gy7tV6PIIEw2aSpbKuiOE5zUrdfKHijLS1CrX6di2rdCWz3230MnOWYRyIFetWhrSPF9k5LzSphdJmNETjrHElDpdShj1s4ILnQWpWcU1acTiMnif850-2BYV-2F5lXeG2jTC-2BOwApN8qupRmwT8fNNE9PPcwErJLxahBxSpmSq91gTlumLJlQuv6Mi-2FueOgXZeZsKYVaksXeYc4hm3iYcmZyYCYz0c5CytX-2FkcYDgjcEPGcMdE4wdmef7F34ZhNuR1BzXUZca-2BlM-2FSHy6Wcv-2B44fNGLavW0-2FgwmkSe7DWrN2Qxs4-2BbmqEK8zVd2B-2F-2BfhLv7s-2BwUYCFzSfpco2w0S0EkPk2QiaigfgYJrhsDWFQrr8XAjN8LEK9fzOOYMlKBdNBCCovn1-2BQdoVowInLACYcfv7UF18ixzp9yjXcoI2GtVtXTFy0zwL-2BunyW6y6aLD3UTkKp7eGuS-2Fs2l9K233QQTHOgsxIsW5yOnAipuno6Jz4FUupJjvG-2FSd7m5GLY99tPmOlknWYVUdaS4l4nbH7zNFdVoP-2Fmr7J9FoB812uhszre4JhgikLbqFLMCT1av4GEdnKOwpstUkw9rVNgxd2MHPktA30uhIQeOnTGGKgw66UsPvJvw-3D	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Ftelegra.ph%2FDavis-Insurance-Agency-LLC-06-28&E=kgarber%40woodlandsbank.com&X=XID311CFbwQP1837Xd1&T=WDLP&HV=U,E,X,T&H=3a14786ee7a8dd2b0305ef5dd961d4108cbfaf34	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://62.133.61.56/Downloads/Full%20Video%20HD%20(1080p).lnk	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://m.exactag.com/ai.aspx?tc=d9476116bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ajeffreyhensley.com%2Fwinner%2F54980%2F%2Fa2VlbGV5LmhvbGdhdGVAMnNmZy5jb20=	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	185.196.9.89
	software.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	rIlzbkxg.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.9.150
	AaSwePhLEn.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.57
	rlytKovocev.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	rrTqdiabb.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	mFduH8XG1f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.9.150
	8uy7ZljOoi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	Dekont-31.05.2024.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	DerI9qwTwK.elf	Get hash	malicious	Kaiji	Browse	185.196.9.180

Process:	C:\Users\user\Desktop\BqDa1EBEUK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\Users\user\Desktop\BqDa1EBEUK.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	5.914119690385502
Encrypted:	false
SSDEEP:	6144:4FH+Bu7AxSB5DrwtaroV0XWo44gdY+3E3mHZf5NWL+rFI:ueA7AqrwtaxlgdY+3E3mo
MD5:	0733702D1847B275961A140D86338CF3
SHA1:	9FEDBBD481EFE7BF36AD9F29D498E713D20A540D
SHA-256:	928A5A928CE6419448FE53F3C8FAE38F246FE6DB7228E38E761C5113A052F55B
SHA-512:	48ACEF460899768931167C62019F06A708C8AE06CBFB714153172CE147D831E55258E5EA634B0325F898AEC2161670A21F22A0AAE3DBB6AC01E3B7578ABC8A4F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L.....xf...........!...&.j...&......>.....................................................@.............................x...x...<................................... ...............................`...@...............P............................text....i.......j.................. ..`.rdata...d.......f...n..............@..@.data...\...........................@....reloc...............v..............@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.795023263375608
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	BqDa1EBEUK.exe
File size:	1'610'240 bytes
MD5:	aa9d475bc02429a35578c7c7495391c0
SHA1:	aefabfe061db6b6013e842c1ff5afb09b5686a6a
SHA256:	edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91
SHA512:	3b058dee4b5a959b64e1ade4206f87a4ec46594b58a270866920318593d98c9025b15d17c3486f1595955238cedde86f1b2a8ebb722cc1668c315a9fcd31560a
SSDEEP:	24576:iUwjiv9SI194bspApcCmILYKV+u9O4qZFIYJnddR+Xk85PPU5cgyXd8UOybz:ROivgHcCmIf+u9YZrpk9BRdhbz
TLSH:	CD758DF721775044F717BF722350497ACBA47A202C51DFA9B14E5DA3C733A42A388AB9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xf................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x54d0be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x667810BC [Sun Jun 23 12:10:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14d068	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x6e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x165000	0x48	.uk8
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14b0c4	0x14b200	e10568eaee832c386f273bc5c1fa5f9e	False	0.7892608354567762	data	7.892081010693948	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.uk8	0x14e000	0x3c630	0x3c800	8b44cc85776ca7ad6bb90af56a5af84b	False	0.5767085808367769	data	6.38152009581441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18c000	0x6e0	0x800	5140979a788770a89120ea37db099585	False	0.3642578125	data	3.7677058451231376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18e000	0xc	0x200	50d3c35f580058964369e5f57c3783a4	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x18c0a0	0x450	data			0.39945652173913043
RT_MANIFEST	0x18c4f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-15:43:58.016995	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49705	6302	192.168.2.5	185.196.9.26
07/01/24-15:44:06.078345	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49705	6302	192.168.2.5	185.196.9.26
07/01/24-15:43:58.383566	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	6302	49705	185.196.9.26	192.168.2.5
07/01/24-15:44:03.740669	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	6302	49705	185.196.9.26	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:43:51.186131001 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 1, 2024 15:43:57.136236906 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:43:57.141140938 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:43:57.142323971 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:43:57.150913954 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:43:57.159437895 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:43:57.984177113 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:43:58.016994953 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:43:58.022028923 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:43:58.383565903 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:43:58.436091900 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:43:59.967310905 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 1, 2024 15:43:59.967323065 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 1, 2024 15:44:00.795516968 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 1, 2024 15:44:02.479899883 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 1, 2024 15:44:02.480065107 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 1, 2024 15:44:03.459609985 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:03.464586973 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.740669012 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.741537094 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.741553068 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.741655111 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:03.744950056 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.744967937 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:03.745049000 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:03.795434952 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.559401989 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.564361095 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564390898 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564424992 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.564460993 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.564543962 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564554930 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564619064 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.564651966 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564662933 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564701080 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.564867020 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564872026 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564877987 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.564912081 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:05.565223932 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569333076 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569366932 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569444895 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569456100 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569529057 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569540977 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.569680929 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:05.570168018 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:06.077522039 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:06.078345060 CEST	49705	6302	192.168.2.5	185.196.9.26
Jul 1, 2024 15:44:06.083195925 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:06.355707884 CEST	6302	49705	185.196.9.26	192.168.2.5
Jul 1, 2024 15:44:06.392554998 CEST	49705	6302	192.168.2.5	185.196.9.26

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 15:44:11.864598989 CEST	1.1.1.1	192.168.2.5	0x3a1d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 15:44:11.864598989 CEST	1.1.1.1	192.168.2.5	0x3a1d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:44:25.228127003 CEST	1.1.1.1	192.168.2.5	0xa74b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 15:44:25.228127003 CEST	1.1.1.1	192.168.2.5	0xa74b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:43:54
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\BqDa1EBEUK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BqDa1EBEUK.exe"
Imagebase:	0x70000
File size:	1'610'240 bytes
MD5 hash:	AA9D475BC02429A35578C7C7495391C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:43:54
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:43:55
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xac0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2247337800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2254089575.0000000003124000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28.2%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	9.7%
Total number of Nodes:	703
Total number of Limit Nodes:	20

Executed Functions

Function 6CCE2F70 Relevance: 83.1, APIs: 24, Strings: 19, Instructions: 7813injectionmemorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?), ref: 6CCE556A
ShowWindow.USER32 ref: 6CCE5580
CreateProcessW.KERNELBASE ref: 6CCE92C1
VirtualAlloc.KERNELBASE ref: 6CCE93D9
Wow64GetThreadContext.KERNEL32 ref: 6CCE9404
VirtualAllocEx.KERNELBASE ref: 6CCE94F7
VirtualAllocEx.KERNEL32 ref: 6CCE95EB
WriteProcessMemory.KERNELBASE ref: 6CCE9691
WriteProcessMemory.KERNELBASE ref: 6CCE9A1D
ReadProcessMemory.KERNEL32 ref: 6CCEA3E1
WriteProcessMemory.KERNEL32 ref: 6CCEA535
WriteProcessMemory.KERNELBASE ref: 6CCEA773
Wow64SetThreadContext.KERNEL32 ref: 6CCEA841
ResumeThread.KERNELBASE ref: 6CCEA850
CloseHandle.KERNEL32 ref: 6CCEA86E
CloseHandle.KERNEL32 ref: 6CCEA892
CreateProcessW.KERNEL32 ref: 6CCEB017
VirtualAlloc.KERNEL32 ref: 6CCEB050
GetThreadContext.KERNEL32 ref: 6CCEB07B
VirtualAllocEx.KERNEL32 ref: 6CCEB0C2
WriteProcessMemory.KERNEL32 ref: 6CCEB19C
ReadProcessMemory.KERNEL32 ref: 6CCEB377
WriteProcessMemory.KERNEL32 ref: 6CCEB3BD
WriteProcessMemory.KERNEL32 ref: 6CCEB417

Strings

$3, xrefs: 6CCE8249
Nw\-, xrefs: 6CCE6444
kernel32.dll, xrefs: 6CCE5586
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CCE90BE
J_X, xrefs: 6CCE9823
X!?, xrefs: 6CCE8C65
+~Zg, xrefs: 6CCEA179
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CCE90EB
CC, xrefs: 6CCE2F90
Cj , xrefs: 6CCE997C
6C, xrefs: 6CCE6286
KV1t, xrefs: 6CCEA97F
WPb, xrefs: 6CCE669D
KV1t, xrefs: 6CCEA909
6C, xrefs: 6CCE6304
ntdll.dll, xrefs: 6CCE559A
@, xrefs: 6CCEB0BA
D, xrefs: 6CCE9096
L^|%, xrefs: 6CCE86A6

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: Process$Memory$Write$AllocVirtual$Thread$Context$CloseCreateHandleReadWindowWow64$ConsoleResumeShow
String ID: CC$6C$6C$+~Zg$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$Cj $D$J_X$KV1t$KV1t$L^|%$Nw\-$WPb$X!?$kernel32.dll$ntdll.dll$$3
API String ID: 2556076057-2906395385
Opcode ID: 750715e48bca522da13448d6ab90ccef0275d25d942c11aea3076c14a811e0de
Instruction ID: a967d439bc27645926910e6baa10210e16dd04db701c6d3b0614e3226cb9fdca
Opcode Fuzzy Hash: 750715e48bca522da13448d6ab90ccef0275d25d942c11aea3076c14a811e0de
Instruction Fuzzy Hash: 76E31332A013158FCB14CE2ECE947DA77F2AF4B314F144699D518A7BA1E6369E89CF04

Function 6CCE11E0 Relevance: 32.9, APIs: 15, Strings: 3, Instructions: 1415filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?), ref: 6CCE194E
GetModuleHandleA.KERNEL32 ref: 6CCE1992
CreateFileMappingA.KERNEL32 ref: 6CCE1DE5
CloseHandle.KERNEL32 ref: 6CCE1F31
MapViewOfFile.KERNELBASE ref: 6CCE1F82
VirtualProtect.KERNELBASE ref: 6CCE23B1
VirtualProtect.KERNELBASE ref: 6CCE2468
FindCloseChangeNotification.KERNELBASE ref: 6CCE25DD
CloseHandle.KERNEL32 ref: 6CCE25EE
CloseHandle.KERNEL32 ref: 6CCE2602

Strings

FSz, xrefs: 6CCE1DF2
@, xrefs: 6CCE23A5
.text, xrefs: 6CCE2324

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileProtectVirtual$ChangeCreateCurrentFindMappingModuleNotificationProcessView
String ID: .text$@$FSz
API String ID: 997343362-2979913545
Opcode ID: cb099cab42409eaf7252778c3ed72701e03a65117c74bcf6d7a5e1cf9bd03b0e
Instruction ID: feb13d301d7eb3c866acac46d02f5be11536dfe148625bf7c0658ed910323d0b
Opcode Fuzzy Hash: cb099cab42409eaf7252778c3ed72701e03a65117c74bcf6d7a5e1cf9bd03b0e
Instruction Fuzzy Hash: 15C2EA79A1021A8FDB08CF7DC9A87DDBBF1AB4B314F108199E919EB791E2358D458F01

Function 00A910B0 Relevance: 18.5, Strings: 9, Instructions: 7260COMMON

Download Yara Rule

Strings

q*i, xrefs: 00A941B4
>10F, xrefs: 00A944FE
3k&0, xrefs: 00A951FA
, xrefs: 00A91368, 00A9136D, 00A952F6, 00A952FB, 00A95D81, 00A95D86, 00A96668, 00A9666D, 00A97866, 00A9786B
@m|, xrefs: 00A91123
`g|, xrefs: 00A910D6
17.g, xrefs: 00A92655
`l|, xrefs: 00A910F8
4M9E, xrefs: 00A978C1

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: q*i$17.g$3k&0$4M9E$>10F$@m|$`g|$`l|$
API String ID: 0-1201283588
Opcode ID: 856bd49764543f22d9cde503d839970adadae2b1bff838e195e0ec6b775ba61c
Instruction ID: f120ae77ee9251f28c591620b8afad2afc66b2db473be6d4335ec790b859c7d0
Opcode Fuzzy Hash: 856bd49764543f22d9cde503d839970adadae2b1bff838e195e0ec6b775ba61c
Instruction Fuzzy Hash: 88E30975F002299FCB64DF68C940A99B7B6EF98310F5181EA981DF7354DA35AE81CF80

Function 6CCE2790 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 305
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6CCE27AE
GetProcAddress.KERNEL32 ref: 6CCE28F6

Strings

ntdll.dll, xrefs: 6CCE27A5
NtQueryInformationProcess, xrefs: 6CCE28E9

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 1646373207-2906145389
Opcode ID: ef308d52b1379068be231604aed869f80e082b7296a7cdbe591b42de2bdfbe5b
Instruction ID: ce4818399ddf78c72ca3721d2c268eae8ab610a63edb64c9fba282ebe4321547
Opcode Fuzzy Hash: ef308d52b1379068be231604aed869f80e082b7296a7cdbe591b42de2bdfbe5b
Instruction Fuzzy Hash: 64B1D271A042468FDB14DFBDC9A97DEBBF5BB4B314F108219D8129BB94E3358909CB01

Function 00A9CBEF Relevance: 6.4, Strings: 4, Instructions: 1419COMMON

Download Yara Rule

Strings

piq, xrefs: 00A9CEBF
$f|, xrefs: 00A9CE71
$f|, xrefs: 00A9D710
piq, xrefs: 00A9D73D

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: $f|$$f|$piq$piq
API String ID: 0-665521201
Opcode ID: 5171bf3af5742e6a5f773ebe69b00cb35443d0576c5a51aa5b8c5e0f69004d77
Instruction ID: 0f00ae1ae95e2babfa98a1c235afef1a33b45677c5d08a5ff275a26185a231fe
Opcode Fuzzy Hash: 5171bf3af5742e6a5f773ebe69b00cb35443d0576c5a51aa5b8c5e0f69004d77
Instruction Fuzzy Hash: 04C26875B406198FCB24DF69C9C4A99BBF2BF88300F1581A9E509AB361DB71ED85CF40

Function 00A98E10 Relevance: 1.7, Strings: 1, Instructions: 492
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/&2B, xrefs: 00A99059

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: /&2B
API String ID: 0-2423729899
Opcode ID: 1f9f14dde8b6b5316f2f9bbe59dd1a90d6a6b06fa76a3b376b1d0a2927719a14
Instruction ID: 9a01e2dffcb0e9075a0c1f67073183b8ec7ae3c84f43fb7b02fae9e0a2f7af2d
Opcode Fuzzy Hash: 1f9f14dde8b6b5316f2f9bbe59dd1a90d6a6b06fa76a3b376b1d0a2927719a14
Instruction Fuzzy Hash: 3D223A75E00209AFCF58CFAAC8946DEB7F2FF98310B14C16AD425AB255DB389A45CF50

Function 00A98DFF Relevance: 1.5, Strings: 1, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/&2B, xrefs: 00A99059

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: /&2B
API String ID: 0-2423729899
Opcode ID: d5016a619ae6b38c05c21de595a04e2998135860351d5f035f0636cb80848934
Instruction ID: 79d6b8645e98b11e243910f45d8d4078dfccc4fc9a9be81a76df25b71c673d5a
Opcode Fuzzy Hash: d5016a619ae6b38c05c21de595a04e2998135860351d5f035f0636cb80848934
Instruction Fuzzy Hash: 96B1E275E00209AFCB48DFAAC495A9DB7F2EF98310F14C1AAD425EB251DB389A40CF50

Function 00A98C50 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.%3y, xrefs: 00A98D4D

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: .%3y
API String ID: 0-2191339442
Opcode ID: 4cbfdcfafe754980f4aefbb12a7fae495d34aa2d355d9d77fe12e85b0fa49395
Instruction ID: fd5ad66d57cabfad0c9fcc74986e13d53265998ae20c57ee9e1e8fcc8a1773a9
Opcode Fuzzy Hash: 4cbfdcfafe754980f4aefbb12a7fae495d34aa2d355d9d77fe12e85b0fa49395
Instruction Fuzzy Hash: 93414833F196350BC7158A6DC8A0552B7D2AB9631074A81BEDC41EBB91EA6DDC09C7D0

Function 00A98C80 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.%3y, xrefs: 00A98D4D

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID: .%3y
API String ID: 0-2191339442
Opcode ID: c1d39bb6ea8bafcc409c87482114b950c2ec59b4710fae3e53a45006989e96fe
Instruction ID: c392077123833bfd62c28689ed6313a74650d3e08474a1d133680ce82da0fcd9
Opcode Fuzzy Hash: c1d39bb6ea8bafcc409c87482114b950c2ec59b4710fae3e53a45006989e96fe
Instruction Fuzzy Hash: 2E314C33F109390797588A6EDC905A2F2D6A7D475034A827DDD46FBB40EE68DD09CBD0

Function 00A9B299 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017b99f9e727e782db257a7a42500acb6ff55c488d8c419be81ce586a7899593
Instruction ID: c8459eb8d967e2c339b61dbf9147b74288ce2c035953fe3ae7d211423b94012f
Opcode Fuzzy Hash: 017b99f9e727e782db257a7a42500acb6ff55c488d8c419be81ce586a7899593
Instruction Fuzzy Hash: B2C11436F201345B8F586B7C2E9827E62D7ABC9700359857DE907EB391DE28CC0543E2

Function 00A9A4F0 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c213f8d8703b4a9b9b805ff20e40defa0a3cf9428d1ce882d237583b855ab89
Instruction ID: 70a05e9538268da09da2ea44a4315c47e19d7f3bd152b6c5f127ff443291f5af
Opcode Fuzzy Hash: 9c213f8d8703b4a9b9b805ff20e40defa0a3cf9428d1ce882d237583b855ab89
Instruction Fuzzy Hash: 3CE1AE35B001249F8B54EB6DD998A6D77F2BF8871075644ADE90AEB360DE34ED00CBD2

Function 00A9E2A0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3ec0efc7015b682f78b568d0d9292a9b1bf55869426d1b5a7087d6e32d75f3
Instruction ID: bc25f9c557d483303b0d75ac93c0195a99b64f710f7ad9adcb31300f0513e262
Opcode Fuzzy Hash: 8e3ec0efc7015b682f78b568d0d9292a9b1bf55869426d1b5a7087d6e32d75f3
Instruction Fuzzy Hash: FBB14735B003098FCB14DFA9D9D4A9DB7F6AF88300B658229E505DF766DA70EC45CB40

Function 6CCEBD58 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CCEBD9F
___scrt_uninitialize_crt.LIBCMT ref: 6CCEBDB9

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 8b06d34b15c7eb1bada45b6401c26d6c82d1d1567aaf3778e5094a84a502faa7
Instruction ID: bb5dcf12c8e5eb5f6fd321271bac6d5fee336bbcc8df4a03365376e8b9ae0968
Opcode Fuzzy Hash: 8b06d34b15c7eb1bada45b6401c26d6c82d1d1567aaf3778e5094a84a502faa7
Instruction Fuzzy Hash: 8441F472E05719ABDB209F56C850BFE3A78EF8B758F114119E92567B40F73089058BE4

Function 6CCEBE08 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CCEBE45
dllmain_crt_dispatch.LIBCMT ref: 6CCEBE5C
dllmain_raw.LIBCMT ref: 6CCEBEA4
dllmain_crt_dispatch.LIBCMT ref: 6CCEBEB7
dllmain_raw.LIBCMT ref: 6CCEBECA

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 202af0fb73eef99d1412954d3d08b61596757dd8c291e0c12cc16cb1fea34ada
Instruction ID: dc5ff94758542b309d2f50ade2921caa6c7f8e0d973c19bcd38dab7a23dc89ca
Opcode Fuzzy Hash: 202af0fb73eef99d1412954d3d08b61596757dd8c291e0c12cc16cb1fea34ada
Instruction Fuzzy Hash: 8D21D172D0171AABCB218F16CC60ABF3A78EF8BA98F014115F9196BB10F7308D018BD4

Function 6CCEBC51 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CCEBC9E

Part of subcall function 6CCEC11B: InitializeSListHead.KERNEL32(6CD49420,6CCEBCA8,6CCFD650,00000010,6CCEBC39,?,?,?,6CCEBE61,?,00000001,?,?,00000001,?,6CCFD698), ref: 6CCEC120

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CCEBD08

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: e020b3da3f80b70556fe2c97142c70a19b03b072b6c02f14d86d5f1ed5bdf9e9
Instruction ID: 1fc95a04cf686eaea6850b6c4df45ff669cab55f35f1628223be33d183632ffe
Opcode Fuzzy Hash: e020b3da3f80b70556fe2c97142c70a19b03b072b6c02f14d86d5f1ed5bdf9e9
Instruction Fuzzy Hash: BB2102326093499ADF107FB5C411BFC3B60AF0F26CF20488AD665ABFC1FB210149C6A9

Function 6CCF228C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CCF22D8
GetFileType.KERNELBASE(00000000), ref: 6CCF22EA

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e153341aa186c48d43107fad1f5b3e858f5a5f7cf03d7a75a77a173fd31b2ffe
Instruction ID: 8f5148f96d14c5fe0440de70c35e52e6a6420bf78fc9a56216a8b529a280ea2d
Opcode Fuzzy Hash: e153341aa186c48d43107fad1f5b3e858f5a5f7cf03d7a75a77a173fd31b2ffe
Instruction Fuzzy Hash: A011A2B160478146DB744F3F88AD622BAACBF47238B74071ED5B696DF1E270D58BC640

Function 00A9F228 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 00A9F298

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27bb58b3b94830e099067fc84564ba969eafc1d679b54d1598ed0579d8f9999b
Instruction ID: 5043238a32ed1a98ddd403003a671637d1fc9f21c5fa7429d8c4ee72056681b9
Opcode Fuzzy Hash: 27bb58b3b94830e099067fc84564ba969eafc1d679b54d1598ed0579d8f9999b
Instruction Fuzzy Hash: 8D1123B5D006199FCB10CF9AD944BDEFBF8FB48320F10812AE818A7250D774A944CFA1

Function 024503C0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 0245041F

Memory Dump Source

Source File: 00000000.00000002.2144632200.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_BqDa1EBEUK.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9f2831090fb7f54758b08e8dbde3af914353c4133684b5eb68ae7dc8a1689660
Instruction ID: 1e8b585422993c893a38756cbf23f366a96759c48042d75917481b7adfd7b107
Opcode Fuzzy Hash: 9f2831090fb7f54758b08e8dbde3af914353c4133684b5eb68ae7dc8a1689660
Instruction Fuzzy Hash: 271136B58002598FCB20CF9AC944BDEBBF4EF88320F24845AD958A7351D778A944CFA5

Function 024503BB Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 0245041F

Memory Dump Source

Source File: 00000000.00000002.2144632200.0000000002450000.00000040.00000800.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_BqDa1EBEUK.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 070344e5b741ca731c3dd5f892dcf010d6ab87b4911e6374d2ce48e1a12fc49b
Instruction ID: b4af47287db39888d699cea5212576043c5405158d703223f460b9494f5aedf7
Opcode Fuzzy Hash: 070344e5b741ca731c3dd5f892dcf010d6ab87b4911e6374d2ce48e1a12fc49b
Instruction Fuzzy Hash: 681158B59002598FCB20CF99C544BEEBBF4EF88320F14846AD558A3241C738A944CFA1

Function 6CCF06D7 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6CCF0185,00000001,00000364,00000000,FFFFFFFF,000000FF,?,6CCEF700,00000000,00000000), ref: 6CCF0718

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9f47d005952b239fc70ff879df430b6b03795f54ffe72bc1de41b13c3dacf882
Instruction ID: 5d24653be618f541ccd9bb52a4f3edfac76d9f753d86fecc4f19c96ff8a55113
Opcode Fuzzy Hash: 9f47d005952b239fc70ff879df430b6b03795f54ffe72bc1de41b13c3dacf882
Instruction Fuzzy Hash: 33F0BB312465A467AB915B274804B4B3B98AF41F68B248153EC7496D80FF70D4038ED1

Non-executed Functions

Function 6CCEC43A Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CCEC446
IsDebuggerPresent.KERNEL32 ref: 6CCEC512
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CCEC52B
UnhandledExceptionFilter.KERNEL32(?), ref: 6CCEC535

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0b4221e5a192ad9cca2da974837ae5aad61df9d8bfbce6f16af3cb46e6493752
Instruction ID: 7d3b98e2a6abdb142bf668b401da12b4abdf4a4052fd207f9d459432c2c52994
Opcode Fuzzy Hash: 0b4221e5a192ad9cca2da974837ae5aad61df9d8bfbce6f16af3cb46e6493752
Instruction Fuzzy Hash: 8031F775D05218DBDF20EFA5D989BCDBBB8BF09304F1041AAE40DAB240EB749A85DF45

Function 6CCF03E7 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CCF04DF
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CCF04E9
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CCF04F6

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8473ef0810b98868c2d608a1cb593066acf6554638329d6d3c98d2520d7f65bc
Instruction ID: 04a74ff540e70dc538063c24e154dedb61466f2929c3b336291516aed1c92a77
Opcode Fuzzy Hash: 8473ef0810b98868c2d608a1cb593066acf6554638329d6d3c98d2520d7f65bc
Instruction Fuzzy Hash: 4C31D67490121CABCF61DF29D988BCDBBB8BF09714F5041DAE41CA7290E7709B858F54

Function 6CCEB450 Relevance: 3.0, Strings: 2, Instructions: 531COMMONLIBRARYCODE

Download Yara Rule

Strings

R=, xrefs: 6CCEBB33
R=, xrefs: 6CCEBBE1

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID:
String ID: R=$R=
API String ID: 0-311461204
Opcode ID: 11241c31d3c464c849eb11d6d0e8bd3260c94e7fa265f772cc88b1595003547d
Instruction ID: 635dc5922a9a2448e5baf0d9badc885e24bb48ca5102dc2f5db558784b232560
Opcode Fuzzy Hash: 11241c31d3c464c849eb11d6d0e8bd3260c94e7fa265f772cc88b1595003547d
Instruction Fuzzy Hash: DD02E236A446058FCF049E7DC9A57EE77F2BB4F314F109215E425FBB94E22A8805CB29

Function 6CCF7045 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CCF7040,?,?,00000008,?,?,6CCF6C43,00000000), ref: 6CCF7272

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2b5acd455b8b14a009d8c36fafe18878f5f514ab7969b25d49a6ff6c11efe70e
Instruction ID: 30144a0ed22d09cb98d15dc8f2206eea6d5321d9a5b05a4cd7f509f8975a95ef
Opcode Fuzzy Hash: 2b5acd455b8b14a009d8c36fafe18878f5f514ab7969b25d49a6ff6c11efe70e
Instruction Fuzzy Hash: C6B16931610608DFEB45CF28C486B947BE0FF45368F258698E8B9CF6A1D735E986DB40

Function 6CCEC5F8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CCEC60E

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5dd62a16efb71f5d9137d3fe822feacafb4ba6fa44ee99822c128a80a5c07f99
Instruction ID: 7cd0b6d3a2d01487e60f476e1f3910159c312de686c82d25e983ee551c3333ee
Opcode Fuzzy Hash: 5dd62a16efb71f5d9137d3fe822feacafb4ba6fa44ee99822c128a80a5c07f99
Instruction Fuzzy Hash: 79517AB2A112058FEB04EF56D981B9EBBF8FB4E318F24856AD614EB640E375D900CF50

Function 6CCF0A98 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03e6545fd883e8dbb5cad951b693fd6b1ad08e57505354fdd18cc71a67127b9
Instruction ID: f6f129e0070e0d0d5a67be54d821d054bfef9e1ced8ac1fdb1527aa0b415d918
Opcode Fuzzy Hash: d03e6545fd883e8dbb5cad951b693fd6b1ad08e57505354fdd18cc71a67127b9
Instruction Fuzzy Hash: 2B41B4B580565DAFDB50DF69CC88AEABBB8EF45708F1442D9E429D3200EB349E85CF50

Function 6CCF21BB Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CCF21BB

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 81202ee66a3d04f28bd2ada6bcc5c9a36dd1c4c58be5ee2ba71ab97b71785a99
Instruction ID: 0645286df9799c3cbcaf5b63a4165e6a649f42d579965229566a061155a6ce59
Opcode Fuzzy Hash: 81202ee66a3d04f28bd2ada6bcc5c9a36dd1c4c58be5ee2ba71ab97b71785a99
Instruction Fuzzy Hash: 46A011B03002008BAF808F3B830A208BAFEAA03A8030AC02AA228C0000EA2080208F02

Function 6CCE2C00 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c196727885f4b5b2d9c89d5d02f51813b1872b388dc284abe932fd95dcab99
Instruction ID: be193f8de1f9d3e30ccbafbf7917b3e15323c1a194154ef554d399bd0a53bd88
Opcode Fuzzy Hash: f3c196727885f4b5b2d9c89d5d02f51813b1872b388dc284abe932fd95dcab99
Instruction Fuzzy Hash: 1191D076A515068FDF08CE7CC9A97DE7BF2EB4B324F148215E921E7784D2399905CB10

Function 00A9ABB0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5867cb6977bc13d1a19a6dbc52252d9c873c87092765593828122c3265daa356
Instruction ID: 54691736d3bb72decc22bf08eaec5bec114362906654bb2f1ef3515099d7f58e
Opcode Fuzzy Hash: 5867cb6977bc13d1a19a6dbc52252d9c873c87092765593828122c3265daa356
Instruction Fuzzy Hash: 2281C437F116399BCB14DAA9C8446DEB7F2AB98310F59816AD815FB340EB749C06CBC1

Function 6CCE1000 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003c22b02adacfae170aecfa91acbaed43997c9018f757a2b37735a19e7c23d0
Instruction ID: 3c4f7ccfbd0b86e710f62795a59c50a585fda6ee9bc6815f64fb2632358c545d
Opcode Fuzzy Hash: 003c22b02adacfae170aecfa91acbaed43997c9018f757a2b37735a19e7c23d0
Instruction Fuzzy Hash: 37514735A041468BDF048F7EC9902DEBBF1AB8B334F24531AC921F77D1E22589169B50

Function 00A9F5A0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f3c87776bf17ee5369d2f806b8c4c3a5db4d24157caeddaaeaf8ac76d82cfd
Instruction ID: 66c7f61d887077d38e28bebe7de4a9c6e69027867cb1857255af472b3319d2bc
Opcode Fuzzy Hash: c3f3c87776bf17ee5369d2f806b8c4c3a5db4d24157caeddaaeaf8ac76d82cfd
Instruction Fuzzy Hash: 30517F76F1012A8F9B08DFADC88559EB7F2AF9C310B0A856AD915FB350D6749C018BD0

Function 00A9EE53 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527e3ca61a9bf754210fb4b3c75ae5d9d8dfd2cc4de04fcc0f23cf8696c6b6e8
Instruction ID: aa5d02362902b49f3ae61a605426a517406caa8dcf85d5de11a4a86dca542f71
Opcode Fuzzy Hash: 527e3ca61a9bf754210fb4b3c75ae5d9d8dfd2cc4de04fcc0f23cf8696c6b6e8
Instruction Fuzzy Hash: 6D41E472F101394F8B14DAADC8446AAB7E7AB9C75070A456AE809FB351EB70CC05C7D0

Function 00A99530 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0cad1c286af0c6fd3355046b7b0fdf27688a6d82e96055f40ff102443b91e3
Instruction ID: 2bd00f1fa075b018b560c29d495eed1591123d00b7daea572b35712acda67c4f
Opcode Fuzzy Hash: 2b0cad1c286af0c6fd3355046b7b0fdf27688a6d82e96055f40ff102443b91e3
Instruction Fuzzy Hash: FA416376F2052D8B9B14CEADC8805DEF7F6BB88310B4A866AE819F7354D6349C058BD4

Function 00A9F878 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3999da6a5fd919d6cc7706d5045a0575a0accbdff8b836ecff5a6498aba69dad
Instruction ID: 49c04f7636af3cf5d277e395049d5108794ae2c2a8b4f788da2719da9cc39a8b
Opcode Fuzzy Hash: 3999da6a5fd919d6cc7706d5045a0575a0accbdff8b836ecff5a6498aba69dad
Instruction Fuzzy Hash: EE31F573F112354FD728CA5DDC844AAF7E2AB9836070B86AAEC59FB351D6749C0587C0

Function 00A9B0F0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144415553.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_BqDa1EBEUK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239d87cc83d926b8ff4004736e1f14fb3721b8773f336237f38bad285b4735af
Instruction ID: 26d8d2f9492238059731bdbce5f47a39e3e57b12439da9dc95989903ce6147b9
Opcode Fuzzy Hash: 239d87cc83d926b8ff4004736e1f14fb3721b8773f336237f38bad285b4735af
Instruction Fuzzy Hash: C131E637F105384B9764CA6ED8444ABF2E7ABC822071B8276E91DFB754D6319C058BD0

Function 6CCEDE7A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CCEDF99
___TypeMatch.LIBVCRUNTIME ref: 6CCEE0A7
_UnwindNestedFrames.LIBCMT ref: 6CCEE1F9
CallUnexpected.LIBVCRUNTIME ref: 6CCEE214

Strings

csm, xrefs: 6CCEDEB7
csm, xrefs: 6CCEDFD0
csm, xrefs: 6CCEDF24

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 4adab088eaa402b982431cdbb53080e813e616da3f1e1a86bc5cc1c91ea53f57
Instruction ID: 59b521058413c2025f94919877a7575c07bc2651b21dde1d2273c56014e6433b
Opcode Fuzzy Hash: 4adab088eaa402b982431cdbb53080e813e616da3f1e1a86bc5cc1c91ea53f57
Instruction Fuzzy Hash: 27B17B31800209EFCF15CFA5C84099EB7B5FF4A358B14466EE814ABB12E335EA55CBD1

Function 6CCECF20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CCECF57
___except_validate_context_record.LIBVCRUNTIME ref: 6CCECF5F
_ValidateLocalCookies.LIBCMT ref: 6CCECFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6CCED013
_ValidateLocalCookies.LIBCMT ref: 6CCED068

Strings

csm, xrefs: 6CCECFFD

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e24df22e3372eacb634554e0fdf4bf5c89c617bd1023fdaf079aca898ca1e467
Instruction ID: 4a6ad7fa8cf5596bb9185c7d040006360e52322b0e38a83b419e933bf1254968
Opcode Fuzzy Hash: e24df22e3372eacb634554e0fdf4bf5c89c617bd1023fdaf079aca898ca1e467
Instruction Fuzzy Hash: B7418434A001599BCF00DF69C880A9EBFB5BF4B31CF148556E924ABB51E731E916CB91

Function 6CCF1DEA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CCF1EF9,00000000,6CCEF700,00000000,00000000,00000001,?,6CCF2072,00000022,FlsSetValue,6CCF9898,6CCF98A0,00000000), ref: 6CCF1EAB

Strings

ext-ms-, xrefs: 6CCF1E55
api-ms-, xrefs: 6CCF1E41

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fba30a30ccf14950e04224cee28b79bbe3eb771a1f34bfe519bcc389ef13b09b
Instruction ID: dec201f547d40b7581b3cc24d336956eaf62a75cf56d014187e3e952542a72d0
Opcode Fuzzy Hash: fba30a30ccf14950e04224cee28b79bbe3eb771a1f34bfe519bcc389ef13b09b
Instruction Fuzzy Hash: 0621D871B01510ABEB619F2AEC48E8A37799F477BCB250211ED35A7680F730E903C6D0

Function 6CCED4CC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CCED101,6CCEC210,6CCEBC29,?,6CCEBE61,?,00000001,?,?,00000001,?,6CCFD698,0000000C,6CCEBF5A), ref: 6CCED4DA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CCED4E8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CCED501
SetLastError.KERNEL32(00000000,6CCEBE61,?,00000001,?,?,00000001,?,6CCFD698,0000000C,6CCEBF5A,?,00000001,?), ref: 6CCED553

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 831ff0b6780d1d3ec00b90d0236512eb17812186cab490b9368f9c84eab93710
Instruction ID: 5ae631d78c76928f48c8f3a754e31a29c0c1c94e6da505281ca48a9634098949
Opcode Fuzzy Hash: 831ff0b6780d1d3ec00b90d0236512eb17812186cab490b9368f9c84eab93710
Instruction Fuzzy Hash: 7701287220F3191DF7003AB67C8095A27B8EB8B3BC364432BE721A1AD0FF514805D284

Function 6CCF101E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\BqDa1EBEUK.exe, xrefs: 6CCF103A

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\BqDa1EBEUK.exe
API String ID: 0-300258628
Opcode ID: ba3c01ad28f180655e531b84cb23638facc7ac57ec492574b32f9075bef843f9
Instruction ID: 3ab993a132d705bf2d1552a24e9274779a406f785a239e65e9785979d21b5000
Opcode Fuzzy Hash: ba3c01ad28f180655e531b84cb23638facc7ac57ec492574b32f9075bef843f9
Instruction Fuzzy Hash: 3C219FB1204285AF9B909F6BC850E9BB7B9BF4136C7048619E938D7A50FB31E8039760

Function 6CCEF02E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,19A9C771,00000000,?,00000000,6CCF7942,000000FF,?,6CCEEFC8,?,?,6CCEEF9C,?), ref: 6CCEF063
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CCEF075
FreeLibrary.KERNEL32(00000000,?,00000000,6CCF7942,000000FF,?,6CCEEFC8,?,?,6CCEEF9C,?), ref: 6CCEF097

Strings

CorExitProcess, xrefs: 6CCEF06D
mscoree.dll, xrefs: 6CCEF05C

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0faabd756dbc98e823a2d96b137b5ab51e78f0ff6016bef169892630da86c0c0
Instruction ID: 32af088f5216d49c2c588b7a6ad814e75df9653fe9448a3b9980628f9dcb99a8
Opcode Fuzzy Hash: 0faabd756dbc98e823a2d96b137b5ab51e78f0ff6016bef169892630da86c0c0
Instruction Fuzzy Hash: F301A231A00659EFDF119F91DC04FAEBBB8FF0A754F004626E831E2680EB759901CA90

Function 6CCF3AA5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CCF3B2A
__alloca_probe_16.LIBCMT ref: 6CCF3BF3
__freea.LIBCMT ref: 6CCF3C5A

Part of subcall function 6CCF2C4A: HeapAlloc.KERNEL32(00000000,6CCF1597,6CCF2964,?,6CCF1597,00000220,?,?,6CCF2964), ref: 6CCF2C7C

__freea.LIBCMT ref: 6CCF3C6D
__freea.LIBCMT ref: 6CCF3C7A

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 51bb70f00b618d9ce64296326005a4cd31ab04c3e2fa63f5158be1d8dc509331
Instruction ID: 76da8229ec74a8d123856364a38a827276900a122772a49af583d36830ccd118
Opcode Fuzzy Hash: 51bb70f00b618d9ce64296326005a4cd31ab04c3e2fa63f5158be1d8dc509331
Instruction Fuzzy Hash: 3851D572A4124ABFEB404F66CC94EFB36A9EF44718F294228FD24D7A50F735C852C661

Function 6CCEDAA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CCEDA53,00000000,?,00000001,?,?,?,6CCEDB42,00000001,FlsFree,6CCF8F70,FlsFree), ref: 6CCEDAAF
GetLastError.KERNEL32(?,6CCEDA53,00000000,?,00000001,?,?,?,6CCEDB42,00000001,FlsFree,6CCF8F70,FlsFree,00000000,?,6CCED5A1), ref: 6CCEDAB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CCEDAE1

Strings

api-ms-, xrefs: 6CCEDAC6

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 655c34e787cd56ffbfc3fe62d599a4d94f447881fddd417862d5ad13e915552f
Instruction ID: 0fe6ba59aa761507e90125ecdb8026e71f0d78e2b4e2565b2e3288943d206358
Opcode Fuzzy Hash: 655c34e787cd56ffbfc3fe62d599a4d94f447881fddd417862d5ad13e915552f
Instruction Fuzzy Hash: C9E01A30748205BBEF101BA2EC05F4A3B76AF47F48F604022FE1CE8991E76196929A95

Function 6CCF41B2 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(19A9C771,00000000,00000000,?), ref: 6CCF4215

Part of subcall function 6CCF1BEC: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CCF3C50,?,00000000,-00000008), ref: 6CCF1C4D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CCF4467
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CCF44AD
GetLastError.KERNEL32 ref: 6CCF4550

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 281758eeebacbad4227bd6b374dafb861895422748ef69091d19ebdfa4a889d3
Instruction ID: 7990323771542902a8c1c9960b646e590b30ac557da9467f7343121918b10816
Opcode Fuzzy Hash: 281758eeebacbad4227bd6b374dafb861895422748ef69091d19ebdfa4a889d3
Instruction Fuzzy Hash: DDD17B75E002589FDF01DFE8C980AEDBBB9FF09318F24452AE565EB741E630A946CB50

Function 6CCEDC23 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CCEDCEA
___AdjustPointer.LIBCMT ref: 6CCEDD0D
___AdjustPointer.LIBCMT ref: 6CCEDDA9

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6c8805e3e553558f9d2c83b5bf113ded53c86ad276e2ca17fc58ef4314aac15f
Instruction ID: 8f7f432037d259cc70daed61872365a5a316c83001a4f4ed493971be0b4c4dac
Opcode Fuzzy Hash: 6c8805e3e553558f9d2c83b5bf113ded53c86ad276e2ca17fc58ef4314aac15f
Instruction Fuzzy Hash: 7451F471A05606DFDB158F15C840BAA77B4FF8F318F20456DD91587A90F731EA81C7A0

Function 6CCF0838 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CCF1BEC: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CCF3C50,?,00000000,-00000008), ref: 6CCF1C4D

GetLastError.KERNEL32 ref: 6CCF089C
__dosmaperr.LIBCMT ref: 6CCF08A3
GetLastError.KERNEL32(?,?,?,?), ref: 6CCF08DD
__dosmaperr.LIBCMT ref: 6CCF08E4

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4d3ccbcd2780fb4994f613e16251175c5da2b6995d9631ffb8d0b103c87d7016
Instruction ID: be975b10f0166a6943eebe153bba76b22df914c4ce4324c57804bd50001e8199
Opcode Fuzzy Hash: 4d3ccbcd2780fb4994f613e16251175c5da2b6995d9631ffb8d0b103c87d7016
Instruction Fuzzy Hash: 7A21F571604389AFDB908F76884089AB7B9FF45B297048529E87997A40FF30EC438BD0

Function 6CCF1C8F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CCF1C97

Part of subcall function 6CCF1BEC: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CCF3C50,?,00000000,-00000008), ref: 6CCF1C4D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CCF1CCF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CCF1CEF

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 77256facea74daff51804823373c831402b11e6eb3fd125458c131d83e344efc
Instruction ID: 451534fa840a6c18a8935c9194de571a46c5be20a95490fe217ce4bdb4500e76
Opcode Fuzzy Hash: 77256facea74daff51804823373c831402b11e6eb3fd125458c131d83e344efc
Instruction Fuzzy Hash: 931104F5A06159BFAB4217BB5C98CAF6E7CDF4A2983100556F831D1600FB30DD0785B0

Function 6CCF5B36 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CCF52E8,00000000,00000001,00000000,?,?,6CCF45A4,?,00000000,00000000), ref: 6CCF5B4D
GetLastError.KERNEL32(?,6CCF52E8,00000000,00000001,00000000,?,?,6CCF45A4,?,00000000,00000000,?,?,?,6CCF4B47,00000000), ref: 6CCF5B59

Part of subcall function 6CCF5B1F: CloseHandle.KERNEL32(FFFFFFFE,6CCF5B69,?,6CCF52E8,00000000,00000001,00000000,?,?,6CCF45A4,?,00000000,00000000,?,?), ref: 6CCF5B2F

___initconout.LIBCMT ref: 6CCF5B69

Part of subcall function 6CCF5AE1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CCF5B10,6CCF52D5,?,?,6CCF45A4,?,00000000,00000000,?), ref: 6CCF5AF4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CCF52E8,00000000,00000001,00000000,?,?,6CCF45A4,?,00000000,00000000,?), ref: 6CCF5B7E

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c1f1c4f59dc94d43b0deb5a0c0c36235178a9a22291ef6407a31911691415800
Instruction ID: dfa3d774390e71bd0042cf71b5740fe907c53177f3cae2fb6b52c15db1c01a43
Opcode Fuzzy Hash: c1f1c4f59dc94d43b0deb5a0c0c36235178a9a22291ef6407a31911691415800
Instruction Fuzzy Hash: D9F0A236600114BBCF521FE6DC08E893F76FF06375F458111FB2995520D6328822DB94

Function 6CCEE21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CCEE244

Strings

RCC, xrefs: 6CCEE25E
MOC, xrefs: 6CCEE256

Memory Dump Source

Source File: 00000000.00000002.2145142829.000000006CCE1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2145124579.000000006CCE0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145180993.000000006CCF8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CCFF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145213688.000000006CD31000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2145623874.000000006CD4A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_BqDa1EBEUK.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 419b471a021fbeaad6608e04bcbd4fbfdaee6bdbb13bc41010f670295861d26e
Instruction ID: 9906d269fb13b94d12557b47b154286b6ce18b34f212f7d6f12d4fc2fedbc50c
Opcode Fuzzy Hash: 419b471a021fbeaad6608e04bcbd4fbfdaee6bdbb13bc41010f670295861d26e
Instruction Fuzzy Hash: B5413972900209AFCF06CF94CC80EEE7BB5FF4A348F188159F91867660E3359951DB91

Analysis Process: MSBuild.exePID: 6444, Parent PID: 5680COMMON

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	130
Total number of Limit Nodes:	13

Executed Functions

Function 05B48398 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 05B485E3
$eq, xrefs: 05B48549
$eq, xrefs: 05B48533
$eq, xrefs: 05B485F9

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: 5b4ef5ae83ce101dba8fed0ecb9c5eb5cf83834823ae7985363087841943733d
Instruction ID: 56cc78393d281c6a7779791928bf115b2224fc0d97039f582e26c497e93168c2
Opcode Fuzzy Hash: 5b4ef5ae83ce101dba8fed0ecb9c5eb5cf83834823ae7985363087841943733d
Instruction Fuzzy Hash: 9CC1C774E01218CFDB64DFA9C9947AEBBB2FF49300F5081A9D409AB254DB34AE85DF50

Function 05B4DED0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;=, xrefs: 05B4E60C, 05B4E611

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID: ;=
API String ID: 0-2162898869
Opcode ID: 6b47d14d940ab80e924f7c566d7d51b4fc7455c46ff8fa45ec2202dfdf9976a5
Instruction ID: f173a18c99b8673c90e1a2b97c55828227d7a735fcbe14c814b5fc8b974c0cbe
Opcode Fuzzy Hash: 6b47d14d940ab80e924f7c566d7d51b4fc7455c46ff8fa45ec2202dfdf9976a5
Instruction Fuzzy Hash: A7C2A174A112298FCBA5DF24D998BADBBB6FB49300F1085E9D409A7354DB34AE85CF40

Function 05B4F660 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 05B4F8E0
1, xrefs: 05B4F965

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 937f1eb93973502d1597d884fe6c53dedd87c6475361f8a23083121b67f5abf3
Instruction ID: 43a1e8f862db709753c9a136e1ecdb2675a4f670819f44b995f58d75286b9cb0
Opcode Fuzzy Hash: 937f1eb93973502d1597d884fe6c53dedd87c6475361f8a23083121b67f5abf3
Instruction Fuzzy Hash: 75F1DD74E01228CFDB28DF65C954BADBBB2BF89301F5091A9D50AA7394DB316E81CF50

Function 05B47410 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05B47475

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d874df4e8dbe19be2154d28ffa5a7dfbd3411c970dbd986d24cb700166b11ee6
Instruction ID: e08f4802cdd3bdbd8e848459c5b3979b359ac2532209f4f4bc056335122b8a53
Opcode Fuzzy Hash: d874df4e8dbe19be2154d28ffa5a7dfbd3411c970dbd986d24cb700166b11ee6
Instruction Fuzzy Hash: A7219F74E01218AFCF18DFA9E484AEDBBB2FB89310F10916AE515B7360DB346845CF64

Function 05B4CAE8 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfaf99e3a32363e33df35c80cd3c219712f0aec115af43c2cb810ed4c511bd88
Instruction ID: 5f5b57554fb0f7060cc15673115008742d7e6664fb87bcc655c40ebf3e70be98
Opcode Fuzzy Hash: dfaf99e3a32363e33df35c80cd3c219712f0aec115af43c2cb810ed4c511bd88
Instruction Fuzzy Hash: 9D229E74E01229CFDB65DF69C990BD9BBB2BF49300F1085EAD509A7250EB346E85CF80

Function 05B4D490 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54c4d1bd5b73f58b504681359b1cf37eb12d37663831ac68ef0bcd53f4adc51
Instruction ID: 8aaa13d675ed24fc8e7ca37db838c163b092c7bacc2ab8d55d5eb2da4e4cb69e
Opcode Fuzzy Hash: d54c4d1bd5b73f58b504681359b1cf37eb12d37663831ac68ef0bcd53f4adc51
Instruction Fuzzy Hash: 6491E074E01229CFDB64DFA9C994B9DBBB2BF49300F1081A9D509A7355DB30AA85CF40

Function 012CD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD136
GetCurrentThread.KERNEL32 ref: 012CD173
GetCurrentProcess.KERNEL32 ref: 012CD1B0
GetCurrentThreadId.KERNEL32 ref: 012CD209

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a2165edf9493cd1d73a7af64f7e5adf8a7e15c8bf536a274d18c2e871c961e28
Instruction ID: 5601c2b41a88b74c5954708c076d5f8af658a315859dad30a26afc069f950143
Opcode Fuzzy Hash: a2165edf9493cd1d73a7af64f7e5adf8a7e15c8bf536a274d18c2e871c961e28
Instruction Fuzzy Hash: 855189B09003498FDB15CFAAD948B9EBFF5EF88310F24846DE119A7361D7746844CB65

Function 012CD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD136
GetCurrentThread.KERNEL32 ref: 012CD173
GetCurrentProcess.KERNEL32 ref: 012CD1B0
GetCurrentThreadId.KERNEL32 ref: 012CD209

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 54b9809614acd25bed67a01ada73157066c1a93ed096828bdeb82e82438532fc
Instruction ID: 6e10eca3f41f7c5fc54920f708cb13b25ab0a81efb537876226f34f911ce495e
Opcode Fuzzy Hash: 54b9809614acd25bed67a01ada73157066c1a93ed096828bdeb82e82438532fc
Instruction Fuzzy Hash: 045156B091020A8FDB14CFAAD948B9EBFF5EF88310F24846DE219A7360D7745984CF65

Function 012C4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59F1

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9ad8787291def81365b49bcf490e46378a0684feed4bd81b7a13b2e333b48d7a
Instruction ID: ec3951ac2c9f29bcf88af16b2cbe430efa43d6130304cd5b7f2d17f39d9eb283
Opcode Fuzzy Hash: 9ad8787291def81365b49bcf490e46378a0684feed4bd81b7a13b2e333b48d7a
Instruction Fuzzy Hash: AF41EFB0D10719CADB24CFAAC884BCEBBF5FF49704F20815AD508AB251DB756945CF90

Function 012C593D Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59F1

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ad31e7db594e855c918ca93cdf9a50b74e338929fc5e74c9051ccd97e175602b
Instruction ID: b626d3bd2871d0997eb41becc73a572bc99dd8d6d465cec8beb2c448a5d7e80d
Opcode Fuzzy Hash: ad31e7db594e855c918ca93cdf9a50b74e338929fc5e74c9051ccd97e175602b
Instruction Fuzzy Hash: DB41DDB0D10719CADB24CFAAC884BCEBBB5FF48304F20815AD508BB251DB756949CF90

Function 012CD2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD387

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3d01bdb11f370e162d848ca73359e6a2e906abb0390b1a91a8a51733e063364
Instruction ID: e618443254c36a47b6343d528a4a0a5f22cab160d7305b0adf2fd3b9a5212455
Opcode Fuzzy Hash: e3d01bdb11f370e162d848ca73359e6a2e906abb0390b1a91a8a51733e063364
Instruction Fuzzy Hash: D021E6B5D002499FDB10CF9AD984ADEBFF5EB48310F14841AE914A7310D374A940CFA5

Function 012CD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD387

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7ef85ed80e18d0d325bc2efc242bff74f788cab7b2dbce11931320f38be16ed5
Instruction ID: 0f3d173d20d8f8a2dd8adc8a1821a39bebd9f00a78bfbc192c008295506508c0
Opcode Fuzzy Hash: 7ef85ed80e18d0d325bc2efc242bff74f788cab7b2dbce11931320f38be16ed5
Instruction Fuzzy Hash: E821C4B59102499FDB10CF9AD984ADEBFF8EB48320F14841AE918A3350D374A954DFA5

Function 012CA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012CB101,00000800,00000000,00000000), ref: 012CB312

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9624444e48ff5b74bc33a478f0686b072a68f315f16b1a294039b4c671466dd1
Instruction ID: 37aa7098fed45b7fcb43ed4337d7b2b4ab798ea371d20a9eb4e8cafa3cbae967
Opcode Fuzzy Hash: 9624444e48ff5b74bc33a478f0686b072a68f315f16b1a294039b4c671466dd1
Instruction Fuzzy Hash: 591114B6D103498FDB10CF9AC845ADEFBF9EB48710F10852EDA19A7200C375A545CFA5

Function 071B4D80 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,071B525E), ref: 071B5366

Memory Dump Source

Source File: 00000002.00000002.2265091163.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_71b0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 443d26c10fe772c8000beedfd59230a4f21eeb0b49c147347e8c05083abc1140
Instruction ID: 538246918c19910f6692e44f0d980455bde9394c6708961bc5271e65a6916193
Opcode Fuzzy Hash: 443d26c10fe772c8000beedfd59230a4f21eeb0b49c147347e8c05083abc1140
Instruction Fuzzy Hash: AA1123B6D003098BCB20CF9AC944ADEFBF5EB88320F14841AD819B7350C3B5A545CFA0

Function 071B52FE Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,071B525E), ref: 071B5366

Memory Dump Source

Source File: 00000002.00000002.2265091163.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_71b0000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 04825e96c5dfb89b4391b92baed8993c432d7a5bc2979747532c24aaf7995dd7
Instruction ID: 4bb08c664437ed414b3e7b42cb173679dde266cbe822aa092394ef5b4f0d8950
Opcode Fuzzy Hash: 04825e96c5dfb89b4391b92baed8993c432d7a5bc2979747532c24aaf7995dd7
Instruction Fuzzy Hash: 8511E2B6D002498BCB20CFAAC444ADEFBF5EF88320F14841AD419A7250D375A545CFA1

Function 05B47066 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 05B470CE

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 2f9b0da408d809485aa067d912f1b01f021df4e233b041c4cea2e6d436a0d0ff
Instruction ID: cf88a1343ff4a164acf91c1c9b42e760c5a9c96f041fd4fe91b29c8017e7b000
Opcode Fuzzy Hash: 2f9b0da408d809485aa067d912f1b01f021df4e233b041c4cea2e6d436a0d0ff
Instruction Fuzzy Hash: 711113759003099FCB20EFAAD549AEEFFF4EB49320F208459D519A7340C7356544CFA1

Function 012CB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012CB086

Memory Dump Source

Source File: 00000002.00000002.2252462753.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12c0000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2890284bcc0341e4fa49cc3ead2509c4a2f63d23694f06f047c0efdc494ee204
Instruction ID: 3dfbc437b9d2a1e916fea9246be1a6c02c49b366e5f19ed3d8f90499f810084e
Opcode Fuzzy Hash: 2890284bcc0341e4fa49cc3ead2509c4a2f63d23694f06f047c0efdc494ee204
Instruction Fuzzy Hash: 0611D2B6C003498FDB20CF9AD444A9EFBF4EB88720F14851ED529A7210C375A545CFA1

Function 05B466C0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05B471BD

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fca48287786f2ca9f670024cca32c27b82f0717817b1deaaecd3d503bdd8eda9
Instruction ID: 394350217b5e5ca68eca2e665c531a123c174733fac48685b0a3471cba77ddb0
Opcode Fuzzy Hash: fca48287786f2ca9f670024cca32c27b82f0717817b1deaaecd3d503bdd8eda9
Instruction Fuzzy Hash: BB1103B59043489FCB20DF9AD449B9EBBF8EB48320F208459D519A7300C778A944CFA5

Function 05B47068 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 05B470CE

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: KeyboardLayout
String ID:
API String ID: 194098044-0
Opcode ID: 530397367e3b28a419d4f008d87cdc375bbeb316cfde558e7464ec8daf751f14
Instruction ID: b1b7c4bdab59b6ab1cf330d18979ec5297ec0b9f88d83e67723116ece29a2e06
Opcode Fuzzy Hash: 530397367e3b28a419d4f008d87cdc375bbeb316cfde558e7464ec8daf751f14
Instruction Fuzzy Hash: 9211E0B59003498FCB20EFAAD549AEEFBF4EB49320F20845AD519A7240C775A944CFA5

Function 05B47166 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05B471BD

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ab22b2791c3065d2f366430bcd61f07a68cd3b5f5c12ced5f73c0a643cf2d1a8
Instruction ID: def05dd5c9447990fbe108b74c711755d9aea8d699899aa5c472861393b70804
Opcode Fuzzy Hash: ab22b2791c3065d2f366430bcd61f07a68cd3b5f5c12ced5f73c0a643cf2d1a8
Instruction Fuzzy Hash: 7A11E2B59003498FCB20DF9AD945BDEBBF8EB48320F24845AD519A7310C779A944CFA5

Function 0121D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2250512161.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_121d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7988b7c84ad47442ad13330a0bd4a3b7cd232e73d8db3cb3ef30e753f5f90e21
Instruction ID: 0637ff6d8b519326470e224ad00fe03d386ab6f0ab423957f5e6581261545014
Opcode Fuzzy Hash: 7988b7c84ad47442ad13330a0bd4a3b7cd232e73d8db3cb3ef30e753f5f90e21
Instruction Fuzzy Hash: C6214871514208EFCB16DF58E9C4B26BFA5FBA8328F20C569D9050B24AC336D406C6A1

Function 0122D03C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2250767354.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_122d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ffeaa28fc52cbfd1383599397ed86c345ee78c452bc8e36e155f7c6940dcdc
Instruction ID: 1055bb3b893796e669b726657c8be6f52df28400d41f7c085f68f49cc687df16
Opcode Fuzzy Hash: d4ffeaa28fc52cbfd1383599397ed86c345ee78c452bc8e36e155f7c6940dcdc
Instruction Fuzzy Hash: 76112FB5614304EFCB16CF64D880B2ABB61FB84314F24CAADE9490B266C33AD506CA60

Function 0121D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2250512161.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_121d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 2a485fa86fcd0669aa1a5b7af3877a44de3886b9b2018f57749b11054334f2f8
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: 17110376404284DFCB16CF54D5C4B16BFB1FB94324F24C6A9D9090B25BC33AD45ACBA1

Function 0122D0BF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2250767354.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_122d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42333b6bb0cbe45242f9bcaed12ff556a9bd02c4e4ee2f36f4f18f3080df89d
Instruction ID: 0bb705e81855d8bc75ff47cbce3d3896fb31b7f713dcb193d3f7ab60025bbe09
Opcode Fuzzy Hash: a42333b6bb0cbe45242f9bcaed12ff556a9bd02c4e4ee2f36f4f18f3080df89d
Instruction Fuzzy Hash: E3016D79504244DFDB05CF54D588B1ABFA1FB84324F28C6A9D9490F32AD33AD517CBA2

Non-executed Functions

Function 05B424F0 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

$eq, xrefs: 05B426A1
$eq, xrefs: 05B425E3

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 0a4da497b857f83b145c28f8afcd36b7f90894142045fb1622a7206644b1bebe
Instruction ID: eaf95074ea070d0388fcc8fa21fe1d72a61b39e3e7b024d9e3931e8323fb6817
Opcode Fuzzy Hash: 0a4da497b857f83b145c28f8afcd36b7f90894142045fb1622a7206644b1bebe
Instruction Fuzzy Hash: 2561BD74E012189FDB14DFA9C884AEDBBF2FF89310F648169E405AB364DB34A946DF50

Function 071BFBD8 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2265091163.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_71b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb5079d7103e4a5aa3d82f297a9f4aa17ea713b73983c7fef2d7cebf9c1c9b3
Instruction ID: 49c9da8709e75b5e8c7e405c9adb9554121fd9b5e30c3a0371593d349645f7a9
Opcode Fuzzy Hash: 6fb5079d7103e4a5aa3d82f297a9f4aa17ea713b73983c7fef2d7cebf9c1c9b3
Instruction Fuzzy Hash: E1C1A274E01218CFDB54DFA9D994A9DBBB2FF89300F2085AAD409AB364DB345D86CF40

Function 071BFBE8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2265091163.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_71b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0794f442be7726626a0eb36b9925d0dc788c59e1485199d98df2aa5b5e707de7
Instruction ID: 36bff7a1c5060c4b743def8d83c9c81788425e1f4adcbe88aeca9724fbba0be7
Opcode Fuzzy Hash: 0794f442be7726626a0eb36b9925d0dc788c59e1485199d98df2aa5b5e707de7
Instruction Fuzzy Hash: 7AC18274E01218CFDB54DFA9D994A9DBBB2FF89300F1085A9D409AB364DB346D86CF50

Function 05B4AB2B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2263262080.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3143fd281d392854d8c62d4730a12d1a76b90228dc16e2bdba5b77a1b2fda7eb
Instruction ID: d8d8a2fbf23daca7912570987b9a7bb560e7a850a4ede1db1eb34db713dc9996
Opcode Fuzzy Hash: 3143fd281d392854d8c62d4730a12d1a76b90228dc16e2bdba5b77a1b2fda7eb
Instruction Fuzzy Hash: D7E09A30CCA10ECAEB20CFA1C254BFFF637AB05200F2064C9C80573294DBB46644AEA9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BqDa1EBEUK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BqDa1EBEUK.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Roaming\d3d9.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
BqDa1EBEUK.exe

Function 6CCE2790 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 305
libraryloaderCOMMON

Function 00A98E10 Relevance: 1.7, Strings: 1, Instructions: 492
COMMON

Function 00A98DFF Relevance: 1.5, Strings: 1, Instructions: 246
COMMON

Function 00A98C50 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Function 00A98C80 Relevance: 1.4, Strings: 1, Instructions: 113
COMMON

Function 6CCEBD58 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CCEBE08 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CCEBC51 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CCF228C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00A9F228 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 024503C0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 024503BB Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 6CCF06D7 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE