Edit tour

Windows Analysis Report
StrangeOstrumV2.exe

Overview

General Information

Sample name:	StrangeOstrumV2.exe
Analysis ID:	1465689
MD5:	d16418fbada8f2a6f41b58b0666c2bda
SHA1:	918047757fafd633f111fc9c47b90e5611341aab
SHA256:	6d8fc5485484ff3a0efee3b5961dd07882f7ab55b472b5884a0a5199ca26f68e
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

StrangeOstrumV2.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\StrangeOstrumV2.exe" MD5: D16418FBADA8F2A6F41B58B0666C2BDA)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.196.9.26:6302", "Authorization Header": "1d35c3d8e5f5b5bc719234554ae131d3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: StrangeOstrumV2.exe PID: 6508	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: StrangeOstrumV2.exe PID: 6508	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 368	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.StrangeOstrumV2.exe.6cf4f000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.StrangeOstrumV2.exe.6cf4f000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.StrangeOstrumV2.exe.6cf30000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 185.196.9.26 - Destination IP: 192.168.2.5

Timestamp:	07/02/24-00:14:56.057211
SID:	2043234
Source Port:	6302
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 185.196.9.26

Timestamp:	07/02/24-00:15:03.599918
SID:	2043231
Source Port:	49704
Destination Port:	6302
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 185.196.9.26

Timestamp:	07/02/24-00:14:55.781650
SID:	2046045
Source Port:	49704
Destination Port:	6302
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 185.196.9.26 - Destination IP: 192.168.2.5

Timestamp:	07/02/24-00:15:01.393903
SID:	2046056
Source Port:	6302
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: StrangeOstrumV2.exe

Avira: detected

Found malware configuration

Source: 0.2.StrangeOstrumV2.exe.6cf30000.4.unpack

Malware Configuration Extractor: RedLine {"C2 url": "185.196.9.26:6302", "Authorization Header": "1d35c3d8e5f5b5bc719234554ae131d3"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: StrangeOstrumV2.exe

ReversingLabs: Detection: 48%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\d3d9.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: StrangeOstrumV2.exe

Joe Sandbox ML: detected

Source: StrangeOstrumV2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: StrangeOstrumV2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF40228 FindFirstFileExW,

0_2_6CF40228

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 185.196.9.26:6302
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 185.196.9.26:6302
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 185.196.9.26:6302 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 185.196.9.26:6302 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.196.9.26:6302

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 185.196.9.26:6302

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26

Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: StrangeOstrumV2.exe, StrangeOstrumV2.exe, 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

System Summary

PE file contains section with special chars

Source: StrangeOstrumV2.exe

Static PE information: section name: qq9WI>4z

PE file has nameless sections

Source: StrangeOstrumV2.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF328C0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,

0_2_6CF328C0

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF328C0	0_2_6CF328C0
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF330C0	0_2_6CF330C0
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF311E0	0_2_6CF311E0
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF3ACE0	0_2_6CF3ACE0
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF467C5	0_2_6CF467C5
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03017330	0_2_03017330
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03012BB8	0_2_03012BB8
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03016500	0_2_03016500
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03017928	0_2_03017928
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03012187	0_2_03012187
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_030118A8	0_2_030118A8
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03016708	0_2_03016708
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03012AD0	0_2_03012AD0
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_030166F8	0_2_030166F8
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03017917	0_2_03017917
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03017540	0_2_03017540
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03014000	0_2_03014000
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03014010	0_2_03014010
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03011810	0_2_03011810
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_0301182F	0_2_0301182F
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_030134A8	0_2_030134A8
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_030134B8	0_2_030134B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00F8DC74	3_2_00F8DC74

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: String function: 6CF3BD50 appears 33 times

Source: StrangeOstrumV2.exe, 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLeve.exe8 vs StrangeOstrumV2.exe
Source: StrangeOstrumV2.exe, 00000000.00000000.2018154025.0000000000E4C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCosmicEdge72981679041.exeT vs StrangeOstrumV2.exe
Source: StrangeOstrumV2.exe, 00000000.00000002.2033540432.000000000134E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs StrangeOstrumV2.exe
Source: StrangeOstrumV2.exe	Binary or memory string: OriginalFilenameCosmicEdge72981679041.exeT vs StrangeOstrumV2.exe

Source: StrangeOstrumV2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: StrangeOstrumV2.exe

Static PE information: Section: qq9WI>4z ZLIB complexity 1.0003341490963855

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@0/1

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:120:WilError_03

Source: StrangeOstrumV2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002DF3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002D76000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: StrangeOstrumV2.exe

ReversingLabs: Detection: 48%

Source: unknown	Process created: C:\Users\user\Desktop\StrangeOstrumV2.exe "C:\Users\user\Desktop\StrangeOstrumV2.exe"
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: StrangeOstrumV2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: StrangeOstrumV2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Unpacked PE file: 0.2.StrangeOstrumV2.exe.df0000.0.unpack qq9WI>4z:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: StrangeOstrumV2.exe	Static PE information: section name: qq9WI>4z
Source: StrangeOstrumV2.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_00E20918 push es; ret	0_2_00E20919
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF46EF4 push ecx; ret	0_2_6CF46F07
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_03015801 push ebp; retf	0_2_03015802

Source: StrangeOstrumV2.exe

Static PE information: section name: qq9WI>4z entropy: 7.999101795606584

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

File created: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: StrangeOstrumV2.exe PID: 6508, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 31F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 57B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 67B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 68E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 78E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 7DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 8DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory allocated: 9DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: EE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 569			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2190			Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe TID: 2128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6592	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4024	Thread sleep count: 569 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4024	Thread sleep count: 2190 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF40228 FindFirstFileExW,

0_2_6CF40228

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LRcq
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MSBuild.exe, 00000003.00000002.2130743477.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: MSBuild.exe, 00000003.00000002.2136896387.0000000003CDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000003454000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LRcq
Source: MSBuild.exe, 00000003.00000002.2132044966.0000000002B97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF3BBDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF3BBDA

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF4194B GetProcessHeap,

0_2_6CF4194B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF3BBDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF3BBDA
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF3FB77 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CF3FB77
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Code function: 0_2_6CF3B701 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CF3B701

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF330C0 HonorInc,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,VirtualAlloc,GetThreadContext,VirtualAllocEx,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_6CF330C0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 782008	Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF3BD98 cpuid

0_2_6CF3BD98

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe	Queries volume information: C:\Users\user\Desktop\StrangeOstrumV2.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\StrangeOstrumV2.exe

Code function: 0_2_6CF3B823 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF3B823

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf4f000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf4f000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf30000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: StrangeOstrumV2.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 368, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 368, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf4f000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf4f000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.StrangeOstrumV2.exe.6cf30000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: StrangeOstrumV2.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 368, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
StrangeOstrumV2.exe	49%	ReversingLabs	Win32.Spyware.RedLine
StrangeOstrumV2.exe	100%	Avira	HEUR/AGEN.1311437
StrangeOstrumV2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\d3d9.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\d3d9.dll	56%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
185.196.9.26:6302	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	Avira URL Cloud	safe
http://tempuri.org/D	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
185.196.9.26:6302	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000003.00000002.2132044966.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	StrangeOstrumV2.exe, StrangeOstrumV2.exe, 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000003.00000002.2132044966.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000003.00000002.2136896387.0000000003AAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	MSBuild.exe, 00000003.00000002.2132044966.0000000002CE3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2132044966.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/D	MSBuild.exe, 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.26	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465689
Start date and time:	2024-07-02 00:14:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	StrangeOstrumV2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 55 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: StrangeOstrumV2.exe

Simulations

Behavior and APIs

Time	Type	Description
18:15:02	API Interceptor	15x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.9.26	BqDa1EBEUK.exe	Get hash	malicious	RedLine	Browse
185.196.9.26	software.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	BqDa1EBEUK.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	185.196.9.89
	software.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	rIlzbkxg.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.9.150
	AaSwePhLEn.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.57
	rlytKovocev.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	rrTqdiabb.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	mFduH8XG1f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.9.150
	8uy7ZljOoi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	Dekont-31.05.2024.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\StrangeOstrumV2.exe.log

Download File

Process:	C:\Users\user\Desktop\StrangeOstrumV2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\Users\user\Desktop\StrangeOstrumV2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	426496
Entropy (8bit):	5.904549086124832
Encrypted:	false
SSDEEP:	6144:/8mSgxOO/OgiPPTZcU6F8ap77RAAKZHp4tJqcVoBRQw:UmSgqgiPDnK77RAAKQqlLZ
MD5:	D922CE4F3346515CA2B68E2087968B2F
SHA1:	795D03F4EA0F6D9EA34E54D6BFA89299C6D667EC
SHA-256:	4BCC0D0119071AE3DCD6377680F762E631591F9DC5EA45A68AD943A48B1F6D1B
SHA-512:	95FDD75A779422174685C91D9782D9D3607D2F7638FCB94A2A19399317D18C8BBEE10CB71738347F55EC87A4B2B705DFBEC995182E6F149C28BB76DBA0A1C566
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 56%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L....Z.f...........!...&.b...&...........................................................@.............................x...x...<...............................L... ...............................`...@...............P............................text...Ca.......b.................. ..`.rdata...d.......f...f..............@..@.data...\...........................@....reloc..L............n..............@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.166152221610949
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	StrangeOstrumV2.exe
File size:	364'544 bytes
MD5:	d16418fbada8f2a6f41b58b0666c2bda
SHA1:	918047757fafd633f111fc9c47b90e5611341aab
SHA256:	6d8fc5485484ff3a0efee3b5961dd07882f7ab55b472b5884a0a5199ca26f68e
SHA512:	0bc4daeb51b6596e248e861b3c293a0d58ffeb46746dd16db42c337fb3b415648d79975af298ea0043393f0063ff43b938ab6097690c756723ce26ef04725fd1
SSDEEP:	6144:XYLVGAk69fIESPUSyvC3WvwKP2XYvy07e1hQRpsJQlGNc8NJRxx+G8WM1ofwipTs:XrAk69fNSGpMYP7uh2sJQlGNc8NJRxxE
TLSH:	F27462DDB65076DFC867D462DEA82CA8EA6035BB932F4203912715ADDA4C897CF140F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.f.................D...H...........`... ....@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46000a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66815AC5 [Sun Jun 30 13:16:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00460000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36750	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x708	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x60000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x36000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
qq9WI>4z	0x2000	0x33d18	0x33e00	f57ccddcf413af6e1616a6326154941f	False	1.0003341490963855	data	7.999101795606584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x36000	0x24060	0x24200	fc44d16c3f2f110dfe40061d1af20a7d	False	0.3633082828719723	data	4.652421089344327	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5c000	0x708	0x800	2e7baaf33ee86baa08da3fd63a36c22e	False	0.3720703125	data	3.804664053466187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5e000	0xc	0x200	1e37c0bd08615c8250069f61ab34fa51	False	0.044921875	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x60000	0x10	0x200	88a4aa968e4a664498a0ecea4cd0615c	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5c0a0	0x478	data			0.3968531468531469
RT_MANIFEST	0x5c518	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-00:14:56.057211	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	6302	49704	185.196.9.26	192.168.2.5
07/02/24-00:15:03.599918	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	6302	192.168.2.5	185.196.9.26
07/02/24-00:14:55.781650	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	6302	192.168.2.5	185.196.9.26
07/02/24-00:15:01.393903	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	6302	49704	185.196.9.26	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:14:51.883590937 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:14:51.883605003 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:14:52.008654118 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:14:54.913260937 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:14:54.920161009 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:14:54.920242071 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:14:54.995621920 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:14:55.003267050 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:14:55.748958111 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:14:55.781650066 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:14:55.786439896 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:14:56.057210922 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:14:56.102480888 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.106290102 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.113192081 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.393903017 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.393940926 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.393953085 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.394031048 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.394052982 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.394088984 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.394094944 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.394136906 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.394149065 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:01.394172907 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.446180105 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:01.492993116 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:15:01.494512081 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:15:01.617986917 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:15:03.131170034 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:03.136182070 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136210918 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136219978 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136229992 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136251926 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:03.136298895 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:03.136548996 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136594057 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136626005 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:03.136661053 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136671066 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.136687994 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.138050079 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141710997 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141721010 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141855001 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141864061 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141899109 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.141907930 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.142004013 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.142013073 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.142066002 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.275608063 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 2, 2024 00:15:03.275719881 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 2, 2024 00:15:03.594124079 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:03.599917889 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:03.604854107 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:04.195666075 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:04.195799112 CEST	6302	49704	185.196.9.26	192.168.2.5
Jul 2, 2024 00:15:04.195862055 CEST	49704	6302	192.168.2.5	185.196.9.26
Jul 2, 2024 00:15:04.247232914 CEST	49704	6302	192.168.2.5	185.196.9.26

Target ID:	0
Start time:	18:14:52
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\StrangeOstrumV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\StrangeOstrumV2.exe"
Imagebase:	0xdf0000
File size:	364'544 bytes
MD5 hash:	D16418FBADA8F2A6F41B58B0666C2BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:14:52
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:14:53
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x540000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2128236804.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2132044966.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	6.8%
Total number of Nodes:	961
Total number of Limit Nodes:	9

Executed Functions

Function 6CF330C0 Relevance: 89.5, APIs: 22, Strings: 25, Instructions: 7264injectionmemorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF3543B
ShowWindow.USER32 ref: 6CF35451
CreateProcessW.KERNELBASE ref: 6CF38AEE
VirtualAlloc.KERNELBASE ref: 6CF38BC4
VirtualAllocEx.KERNELBASE ref: 6CF38DE7
VirtualAllocEx.KERNEL32 ref: 6CF38EF6
WriteProcessMemory.KERNELBASE ref: 6CF38F94
WriteProcessMemory.KERNELBASE ref: 6CF39308
ReadProcessMemory.KERNEL32 ref: 6CF39CB4
WriteProcessMemory.KERNEL32 ref: 6CF39DB1
WriteProcessMemory.KERNELBASE ref: 6CF3A01D
Wow64SetThreadContext.KERNEL32 ref: 6CF3A0CA
ResumeThread.KERNELBASE ref: 6CF3A0D9
CloseHandle.KERNEL32 ref: 6CF3A229
CloseHandle.KERNEL32 ref: 6CF3A238
VirtualAlloc.KERNEL32 ref: 6CF3A9A0
GetThreadContext.KERNEL32 ref: 6CF3A9DF
VirtualAllocEx.KERNEL32 ref: 6CF3AA21
WriteProcessMemory.KERNEL32 ref: 6CF3AC12
SetThreadContext.KERNEL32 ref: 6CF3AC74
ResumeThread.KERNEL32 ref: 6CF3AC83

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CF38A70
yGH, xrefs: 6CF37801
)6y, xrefs: 6CF3873D
"[#, xrefs: 6CF370CA
~*:y, xrefs: 6CF39CC1
@, xrefs: 6CF3AA19
9&=x, xrefs: 6CF35E9D
m0R, xrefs: 6CF37E62
yY, xrefs: 6CF355B7
{1Z, xrefs: 6CF38B85
D, xrefs: 6CF389FD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CF38A43
kernel32.dll, xrefs: 6CF35457
&3, xrefs: 6CF35F99
yGH, xrefs: 6CF37862
{1Z, xrefs: 6CF38C4F
rdUl, xrefs: 6CF3964E
"[#, xrefs: 6CF37081
r, xrefs: 6CF3A1F9
zx, xrefs: 6CF35EFD
\/LV, xrefs: 6CF35C78
zx, xrefs: 6CF330E0
ntdll.dll, xrefs: 6CF3546B
m0R, xrefs: 6CF37DDC
rdUl, xrefs: 6CF395AD

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: Process$Memory$AllocThreadVirtualWrite$Context$CloseHandleResumeWindow$ConsoleCreateReadShowWow64
String ID: )6y$9&=x$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$\/LV$kernel32.dll$m0R$m0R$ntdll.dll$rdUl$rdUl$yY${1Z${1Z$~*:y$"[#$"[#$&3$yGH$yGH$zx$zx$r
API String ID: 464527381-2271936391
Opcode ID: dc988b7711e2069c728f21f8227db0891037de1ac5df577e15ac65385b9a8958
Instruction ID: 2531fb8bdc8c1e3d391882baec12e93daf382f8f380b9475fef6f52565cab186
Opcode Fuzzy Hash: dc988b7711e2069c728f21f8227db0891037de1ac5df577e15ac65385b9a8958
Instruction Fuzzy Hash: 1AD31432A14225AFCF14CF2DC9843DA77F2AB87354F10A696D41CDB794DA358B899F80

Function 6CF311E0 Relevance: 32.9, APIs: 16, Strings: 2, Instructions: 1366filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?), ref: 6CF318A1
GetModuleHandleA.KERNEL32 ref: 6CF318DF
K32GetModuleInformation.KERNEL32 ref: 6CF31B6A
GetModuleFileNameA.KERNEL32 ref: 6CF31B99
CreateFileA.KERNELBASE ref: 6CF31BDD
CloseHandle.KERNEL32 ref: 6CF31E07
VirtualProtect.KERNELBASE ref: 6CF324AD
CloseHandle.KERNEL32 ref: 6CF3265F
GetCurrentProcess.KERNEL32 ref: 6CF3275F
GetModuleHandleA.KERNEL32 ref: 6CF3279D
CloseHandle.KERNEL32 ref: 6CF327F1

Strings

@, xrefs: 6CF322DF
.text, xrefs: 6CF3224C

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: Handle$Module$Close$CurrentFileProcess$CreateInformationNameProtectVirtual
String ID: .text$@
API String ID: 3681693246-3116941980
Opcode ID: 7c3ec1ae0e70b5640d6f73775462454827e4e53bc8671a2f22d46ee17cc93ae8
Instruction ID: 17aa60bf71b65d44a6c23bbe27a1850a27824ecf206c60aafb7b380c3810114a
Opcode Fuzzy Hash: 7c3ec1ae0e70b5640d6f73775462454827e4e53bc8671a2f22d46ee17cc93ae8
Instruction Fuzzy Hash: DAC2EF76A15224DFDF14CF2CC9A97DEBBF1AB46300F00A19AD90DD7751C6368A898F81

Function 6CF328C0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ntdll.dll, xrefs: 6CF32BB9
NtQueryInformationProcess, xrefs: 6CF32BCD

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID:
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 0-2906145389
Opcode ID: 0531b74562300996d4f159e9037cff868bca4aa1ff267c54123510798c5b348d
Instruction ID: 79cbf9c2726ed43695552e1b0a9998a5430750bca2e27581667954ffcae62734
Opcode Fuzzy Hash: 0531b74562300996d4f159e9037cff868bca4aa1ff267c54123510798c5b348d
Instruction Fuzzy Hash: C9F12276B11215AFCF04CF7CD9993CE77F2AB4A314F10A119E419EB796C63A8A048BD1

Function 03012187 Relevance: 3.0, Strings: 2, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{EL, xrefs: 03012C3C
-nyU, xrefs: 03012E47

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: {EL$-nyU
API String ID: 0-345358387
Opcode ID: 7d6caa71c9d53c1f36edb88862a5241b027b3e774d18ffe78363209cd536cd5f
Instruction ID: 6af29a093150751752e28be7287824dd9bbd83ae323f17a40f1e38f408b0141c
Opcode Fuzzy Hash: 7d6caa71c9d53c1f36edb88862a5241b027b3e774d18ffe78363209cd536cd5f
Instruction Fuzzy Hash: 9502E271A05251CFCB56CF78C98066ABBF9FF5A310B158CA6D801DF266E334E951CB82

Function 03012AD0 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{EL, xrefs: 03012C3C
-nyU, xrefs: 03012E47

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: {EL$-nyU
API String ID: 0-345358387
Opcode ID: 93ef3fb51f1bbea36a5e83887317e596ccb7c3438c92d7800c408acb85c7a2bd
Instruction ID: 89a27278efaa0cce9c7966b57bdbb0a6ece7388b4da1810635683a5e31b22e8f
Opcode Fuzzy Hash: 93ef3fb51f1bbea36a5e83887317e596ccb7c3438c92d7800c408acb85c7a2bd
Instruction Fuzzy Hash: BCB18C72905251CFCB56CF38C9C161ABBF9EF563107164CA6D802DF26AE335E961CB42

Function 03012BB8 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{EL, xrefs: 03012C3C
-nyU, xrefs: 03012E47

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: {EL$-nyU
API String ID: 0-345358387
Opcode ID: 6d430f789bf16b6ed5a9be807e182365bbf6c6b4252e337ab5247fafab33cb05
Instruction ID: 9237416bef95dcccf83b414d1cca4397463f15e8ce0b3a1b1382920dbba059a6
Opcode Fuzzy Hash: 6d430f789bf16b6ed5a9be807e182365bbf6c6b4252e337ab5247fafab33cb05
Instruction Fuzzy Hash: 7A71A071A05152CFCB54CF2CCAD152FBBADAB94300B528C96D906DF26AC730ED61CB85

Function 03011810 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 03011A07
Tecq, xrefs: 030118C3

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: 8496baf4ae1b5ee805a7a152968c895221826fce08a25264b019487afbfa95df
Instruction ID: 902d0c520493134ae61ca43eadde7edb4001ded2d9b9c07c35e8dc342ae17411
Opcode Fuzzy Hash: 8496baf4ae1b5ee805a7a152968c895221826fce08a25264b019487afbfa95df
Instruction Fuzzy Hash: D7610471A053168FCB59CFA8C8806AEBBF2FF8A310B1444A9D502EF359D7745E11CB92

Function 0301182F Relevance: 2.7, Strings: 2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 03011A07
Tecq, xrefs: 030118C3

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: e6b97745521612322e3a4b6480b75d4972b95febd2698f7768f820aa3846a078
Instruction ID: b7b75790ecbd3ca4594d1919838bf6efdeb2351fc9f3d0c52b2c476e72e8508a
Opcode Fuzzy Hash: e6b97745521612322e3a4b6480b75d4972b95febd2698f7768f820aa3846a078
Instruction Fuzzy Hash: 3C510671A053168FCB49CFB9C8906AEBBF2FF8A310B1444A9D506EF355D6745A01CB92

Function 030118A8 Relevance: 2.6, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 03011A07
Tecq, xrefs: 030118C3

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: 855fad47d9fc877606f59d51e2940a8ea19a8e7d5a37d515ca8f295605642c01
Instruction ID: 4016bac755354bb1a580ed37abf8cc1b2490c42929745858480a33f13e101dbb
Opcode Fuzzy Hash: 855fad47d9fc877606f59d51e2940a8ea19a8e7d5a37d515ca8f295605642c01
Instruction Fuzzy Hash: 9F41BB70F052168FCB48DFA9C89456FBBB6FB89600F108429D516EB394CA749D01CB91

Function 03016500 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

$cq, xrefs: 0301658E

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: $cq
API String ID: 0-2110363268
Opcode ID: 6192c543031e914e3d1ed9ee3937d4ab3204dbd7cbca50626bbb1c874facee0e
Instruction ID: d364aadbbffc53d45102aff63d25ddc6ab710925e6b0294dd82d137f19113a65
Opcode Fuzzy Hash: 6192c543031e914e3d1ed9ee3937d4ab3204dbd7cbca50626bbb1c874facee0e
Instruction Fuzzy Hash: 7341C274B012059FC754DB79891472F7BABBBC8700F24882DE50ADB399EE35DD028BA1

Function 03017330 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

z3h, xrefs: 0301746A

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: z3h
API String ID: 0-3127756237
Opcode ID: be3690afc51e532850ecd63c2b71401fc9fcd9f32a7a3bb6914763bbc166899c
Instruction ID: a9c996c6a6382f3709a869eb3cb05731a96fefe776507e935f6c1857821dd29b
Opcode Fuzzy Hash: be3690afc51e532850ecd63c2b71401fc9fcd9f32a7a3bb6914763bbc166899c
Instruction Fuzzy Hash: DD312071306302C7CBA8DA3A855923F698B5BC4A407484A7E9C47CB390EE34DD61839B

Function 03017540 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b9811d612064075faa49cba6e9f02032847ed66dc77ce4c035ba8ce227e5e1
Instruction ID: 17a30d05a4f92042058dafbe08953034dbfbf981fd7c689b3f6e83a86c2d3ca8
Opcode Fuzzy Hash: 17b9811d612064075faa49cba6e9f02032847ed66dc77ce4c035ba8ce227e5e1
Instruction Fuzzy Hash: F2A1EF30F192148BCB19CB2CC59156EFBF6AFC5700B68C9AAE496DB368C670ED51CB50

Function 03017917 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f40c65090706571b8cec8dc06a881d6ec9cb1035f2ab245b3903c64a2440732
Instruction ID: 58961186a193e8a8ce1a9fdbedc22e6e5a2ac8b0283cfc8ff85fca9382a1caad
Opcode Fuzzy Hash: 1f40c65090706571b8cec8dc06a881d6ec9cb1035f2ab245b3903c64a2440732
Instruction Fuzzy Hash: 97417F31B16115CBC784CAB9DE4017FB6A9AFC1E1072158279807DF6D4DF30CE2A8792

Function 03017928 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171af1b6823bae407c7f72ec8c1c077ed505167cd0cad79bda01f2d049854524
Instruction ID: f7259a4718ce427102a0ca5227fd6cf739108c36c53f76c6befdabc5f8ffe4df
Opcode Fuzzy Hash: 171af1b6823bae407c7f72ec8c1c077ed505167cd0cad79bda01f2d049854524
Instruction Fuzzy Hash: B6415D31B16115CBC784DAB9DE8117FB5AAAFD1A10721582B9807DB6D4DF30CE1A8782

Function 6CF3B4F8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF3B53F
___scrt_uninitialize_crt.LIBCMT ref: 6CF3B559

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2472b6c04cee2c7dd8d430604231bd1aa4a5a3a9191a2dbd27bd9a2455d56d69
Instruction ID: b29a0e54b4a6b0a5fc7923a96f67de55cbae1023faf6f7db1204a7226cb30e07
Opcode Fuzzy Hash: 2472b6c04cee2c7dd8d430604231bd1aa4a5a3a9191a2dbd27bd9a2455d56d69
Instruction Fuzzy Hash: 61419272E05A39FEDB118F65CC50BDE7BB4EB80758F115959E81C67B50D7308A058BE0

Function 6CF3B5A8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CF3B5E5
dllmain_crt_dispatch.LIBCMT ref: 6CF3B5FC
dllmain_raw.LIBCMT ref: 6CF3B644
dllmain_crt_dispatch.LIBCMT ref: 6CF3B657
dllmain_raw.LIBCMT ref: 6CF3B66A

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: a1c370aa46f6ae4558e1c9b1fbb6d3c9619d14f9795ec8ae3d68ec03196736a6
Instruction ID: bde867fb6c0823ee7fa49f9303b084c8570b373a191b9ff78612e6385199ead6
Opcode Fuzzy Hash: a1c370aa46f6ae4558e1c9b1fbb6d3c9619d14f9795ec8ae3d68ec03196736a6
Instruction Fuzzy Hash: 9B21A072E05A39FBCB218F16CC50AAF3A79EB80B98B115955E81C5BA50C7308D018BE0

Function 03010A6E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 03010B5C

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1df3e3392292f3b4b5d2f15bf43eb6f7182a8f27ec340e0bdcf1c5ae52fe5222
Instruction ID: b391f95b32476c8a1ad569f6258941666c41d9affa7b5ea57b3a1810401a1d20
Opcode Fuzzy Hash: 1df3e3392292f3b4b5d2f15bf43eb6f7182a8f27ec340e0bdcf1c5ae52fe5222
Instruction Fuzzy Hash: 5C81FFB1C02345CFCB6ACF69C480A9ABBF0FF1A314F5884ADD4959B216E372A951CF51

Function 03010AA9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 192
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Strings

@, xrefs: 03010B5C

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 6307cf610085e3beb34eb8254b9981bf1731856608ea6ddfb7290680cb0914d6
Instruction ID: 0051bf9422ddc8ae16226716ca6ccbf910b5fe89cf03e94de732357b1805c81f
Opcode Fuzzy Hash: 6307cf610085e3beb34eb8254b9981bf1731856608ea6ddfb7290680cb0914d6
Instruction Fuzzy Hash: F971E0B1C02344DFCBAACF69C480A9ABBF0FF16314F5884ADD4959B215E372A951CF51

Function 6CF3B3F1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CF3B43E

Part of subcall function 6CF3B8BB: InitializeSListHead.KERNEL32(6CF99420,6CF3B448,6CF4D650,00000010,6CF3B3D9,?,?,?,6CF3B601,?,00000001,?,?,00000001,?,6CF4D698), ref: 6CF3B8C0

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CF3B4A8

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: c533f914f0eb942f79f52ea1f23751376dea1648a3bbc4f76c93a34b562b1373
Instruction ID: a7f9168ffad60e850366c3b779782acc44428be1b6b20566465bfc4a78071540
Opcode Fuzzy Hash: c533f914f0eb942f79f52ea1f23751376dea1648a3bbc4f76c93a34b562b1373
Instruction Fuzzy Hash: 8321D431605A25BDEF00AFB8C4317CC3BA05F4226CF11AC1AC85C67F82CB220548C6E9

Function 6CF41A1C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CF41A68
GetFileType.KERNELBASE(00000000), ref: 6CF41A7A

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3606b76faabfd5c16f6a0727c633333b0f3728d81285889defd1d783cf34e4f8
Instruction ID: 98af4e04b0b13457c1a5f5f8b85f4f2de603f06121c03af76fc40a22731c609f
Opcode Fuzzy Hash: 3606b76faabfd5c16f6a0727c633333b0f3728d81285889defd1d783cf34e4f8
Instruction Fuzzy Hash: E3119A737147414AC7348E3E8D84712BEA49757274B35C71AD1B6C6AF3C630D6A6C281

Function 030108E2 Relevance: 1.7, APIs: 1, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b549b71ab3f157111c8e3cb02f74162a13f29809f931b026e4f5352778c31f86
Instruction ID: 99835ffed64213baa40af5af40ffd96e1442c9b4b96fa120500c807d786abf1a
Opcode Fuzzy Hash: b549b71ab3f157111c8e3cb02f74162a13f29809f931b026e4f5352778c31f86
Instruction Fuzzy Hash: 5C81FFB1901345CFCB56CF79C880AEABBF0FF5A324F1440A9D044DB222E3769951CB91

Function 03010C37 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f65126f06a0272cf042c16d8285736b276d220b7e59ea03ece47c62b977db2
Instruction ID: d11d2683cf0e345a83441b5605324b5fe3f9920e9a90b7695fd0e91c5bfb091e
Opcode Fuzzy Hash: 96f65126f06a0272cf042c16d8285736b276d220b7e59ea03ece47c62b977db2
Instruction Fuzzy Hash: AA61B1B2C01344CFCB66CF69C88469ABBF4FF1A314F1884AAD495DB216E372A551CF51

Function 03010F7C Relevance: 1.7, APIs: 1, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7ccabd881b8482dd42441c1d71478be4c903493f34c6203982174ddcdef0ee8c
Instruction ID: cbc3609a216a004118d892792cb8e574c75d95a7d435552f4d2bc75a9b717849
Opcode Fuzzy Hash: 7ccabd881b8482dd42441c1d71478be4c903493f34c6203982174ddcdef0ee8c
Instruction Fuzzy Hash: 2C61D2B2C02344CFCB66CF69C880A9ABBF4FF1A314F1884A9D499DB211E376A551CF51

Function 030109B2 Relevance: 1.7, APIs: 1, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54abb69e5ef1f259fdfb632b8ed6b0a47d0a40e04c991f787dd0410bc6184785
Instruction ID: d62b9a5004ef07fbe7666b58dca8a245b8b1c8d6e8fbe1b6d00f6a56e4d4b527
Opcode Fuzzy Hash: 54abb69e5ef1f259fdfb632b8ed6b0a47d0a40e04c991f787dd0410bc6184785
Instruction Fuzzy Hash: 1A51BEB2801345CFCB66CF69C88079ABBF4FF1A324F1884A9D484DB216E376A951CF51

Function 03010DF0 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c15de0f77ebb618ce228e535fd16a177fa7b03a52624d97651999c91abaa25d
Instruction ID: abead54c0068dd1e61a53e9d6e02ff07789202c35e827990f06cb3edaa1a338f
Opcode Fuzzy Hash: 5c15de0f77ebb618ce228e535fd16a177fa7b03a52624d97651999c91abaa25d
Instruction Fuzzy Hash: 5A51ACB2801355CFCB66CF69C881A9ABBF4FF1A324F1544A9D484DB211E336A951CF51

Function 03010BE5 Relevance: 1.6, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 31f9c05e0627580920cb251cc6c6e862e87f2efa15ee9a4f20b3f3eb26e42cb1
Instruction ID: 88bf6dbf029e09bf8c2d025457720d522a9b8d3865a10cf6d2546c540d5fbb70
Opcode Fuzzy Hash: 31f9c05e0627580920cb251cc6c6e862e87f2efa15ee9a4f20b3f3eb26e42cb1
Instruction Fuzzy Hash: C1519DB28013458FCB66CF69C880BDABBF4FF1A324F1544A9D4849B212E376A551CF51

Function 03010D73 Relevance: 1.6, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4c4531d08f217dcc48914ee185a305d91c8cc88d87a30579c47b0beabecc6648
Instruction ID: c235fb1b9165bdfed74b5fc3d591a15d5a9c1fcc0976f9835b8cd34921171f56
Opcode Fuzzy Hash: 4c4531d08f217dcc48914ee185a305d91c8cc88d87a30579c47b0beabecc6648
Instruction Fuzzy Hash: A851BEB2801345DFCB66CF69C881BDABBF4FF1A324F1444A9D4889B212E376A551CF51

Function 03010DA1 Relevance: 1.6, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 49006523b88d12c8378b8bdfa58543b59a6868efc8f1ad31ba88abc8ce46129d
Instruction ID: 5c0e376a5c0c263defbcba77da2d390d0fddb3a3096c97f7a60e824da0e14641
Opcode Fuzzy Hash: 49006523b88d12c8378b8bdfa58543b59a6868efc8f1ad31ba88abc8ce46129d
Instruction Fuzzy Hash: 7D51BFB2801345CFCB66CF69C880B9ABBF4FF1A324F1884A9D4849B212E376A551CF51

Function 03010CBB Relevance: 1.6, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 51c5fafbe9bfb19d3a6cf4bc271c50bc4086ad19ce25a577b528ad5750b61a20
Instruction ID: 4b68bb6505c382df6d1a5d83da91a172393c3a90bc963bf6ce2a6db1abb1b899
Opcode Fuzzy Hash: 51c5fafbe9bfb19d3a6cf4bc271c50bc4086ad19ce25a577b528ad5750b61a20
Instruction Fuzzy Hash: 1851BFB2801345CFCB66CF69C880BDABBF4FF1A324F1484A9D4849B212E376A551DF51

Function 03010DCD Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7181ab77a286a3fa8e64cb51eeb0cff0ae7f7d764356510bd062216b852fb91
Instruction ID: ad6af35b90e2ea9f309503b076e3c34f26bf4d879b0e37071c44639bfc7943f3
Opcode Fuzzy Hash: f7181ab77a286a3fa8e64cb51eeb0cff0ae7f7d764356510bd062216b852fb91
Instruction Fuzzy Hash: 5651AEB28013558FCB66CF69C880B9ABBF4FF1A324F1484A9D4849B216E3766951CF51

Function 03010B94 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f72224a6806d82393153cd06cb41ec70881ef0689a3a8bf2e151e678a99abd
Instruction ID: 98c2a6506d347a1bcb4b66d5c7f3938326f334b327902bf87134143ec27d179a
Opcode Fuzzy Hash: b0f72224a6806d82393153cd06cb41ec70881ef0689a3a8bf2e151e678a99abd
Instruction Fuzzy Hash: C051AEB28013458FCB66CFA9C880BDABBF4FF1A324F1484A9D484DB216E3766951CF51

Function 0301640B Relevance: 1.6, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0301649B

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e35bd7c272dd01544c8b0de7d7bded2eca3ff4cd27f77fadc1e525c3c020559f
Instruction ID: 957ca2cad41a07085c3070c6c456edeb587c3bc629c3cc6f25573881a27d9cad
Opcode Fuzzy Hash: e35bd7c272dd01544c8b0de7d7bded2eca3ff4cd27f77fadc1e525c3c020559f
Instruction Fuzzy Hash: 342137B2C002499FCB10CFAAD484ADEFFF4EB49310F14846AE898A7251C339A545CF61

Function 03016FE8 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 03017F70

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3d55a306dbd56120eb805577ac0644398e7b02f5b6cd636114d6b23430be254e
Instruction ID: 87cbe35813142c190342df7c53b096ee5c9cb88df6eb8b90d37c50eae7af71f9
Opcode Fuzzy Hash: 3d55a306dbd56120eb805577ac0644398e7b02f5b6cd636114d6b23430be254e
Instruction Fuzzy Hash: FB2144B1C046199BCB10DF9AD844A9EFBF4FB48710F10812AE829A3340D374A914CFE5

Function 03011100 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03011173

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b2ad23e655f0ef92a9a7532542662e59766cdd2bf04cff9148ac94a88b73b1dc
Instruction ID: 23fb870d1be4327368d519d56f408fc67e6e3b6cba238637f1c81c23c114eca5
Opcode Fuzzy Hash: b2ad23e655f0ef92a9a7532542662e59766cdd2bf04cff9148ac94a88b73b1dc
Instruction Fuzzy Hash: 3721F6B6D002499FCB10DF9AD984BDEFBF8FB48320F108429E959A7250D379A545CFA1

Function 03016428 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0301649B

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 27f216cab1f709e453a30dae9f7ace706399b27ee7fc55639520c31de814b5f7
Instruction ID: 618f17c66c6ee1524dcda340e8a78a75a4421eeda7855d27c42fec4b23f80e55
Opcode Fuzzy Hash: 27f216cab1f709e453a30dae9f7ace706399b27ee7fc55639520c31de814b5f7
Instruction Fuzzy Hash: 4F2126B2D002499FCB10DF9AD884BDEFBF4FB48320F108429E858A3250D379A544DFA1

Function 03017EF9 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 03017F70

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9ff2500e1c6b34763c6cadd5c99e88e237961618e3a974e3ad566cfa6e007b0
Instruction ID: b436f41aef15b56efce32601e7e2f1cb398e452c0edd2a063d771069f872752f
Opcode Fuzzy Hash: d9ff2500e1c6b34763c6cadd5c99e88e237961618e3a974e3ad566cfa6e007b0
Instruction Fuzzy Hash: D52156B1C0465A8BCB14CFAAD844ADEFBF4FF49720F14825AE429B7240C334A944CFA1

Function 03016FDC Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 030182EF

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d427489c27836cc2e0f616354a9aad1a86055fd6fdd014c0a60a4397c687ad8
Instruction ID: eacfbae2a1bcd6fb02688a9f881f0be652daee7d283b2672b02d211c96362669
Opcode Fuzzy Hash: 9d427489c27836cc2e0f616354a9aad1a86055fd6fdd014c0a60a4397c687ad8
Instruction Fuzzy Hash: CF1146B1C007498FCB10DF99C444BDEFBF4EB88320F248429E519A7340D778A944CBA5

Function 03018288 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 030182EF

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0e943aea8c3a65664460ea8b5a7691dc6a9c7e071fc4fdfb56f9ead1c2ab5489
Instruction ID: 3e07d53c00666c77cbfc9569b2ce74f3876ddd2ef162cb34ea2a940e93c0702a
Opcode Fuzzy Hash: 0e943aea8c3a65664460ea8b5a7691dc6a9c7e071fc4fdfb56f9ead1c2ab5489
Instruction Fuzzy Hash: C21185B2C003498FCB10CFA9C545BEEBBF0EF48320F24885AD418A7240D338A545CFA5

Function 6CF423DA Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6CF40D27,6CF420F4,?,6CF40D27,00000220,?,?,6CF420F4), ref: 6CF4240C

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 108ae247cccad6efdf82b61b86059a5fc6fa1991ead362d0f7dc35f39638f920
Instruction ID: 61d4f37da8f77f0540e92f0c1d95055215aef9594f4ae95aa77d05e19e0a6c3a
Opcode Fuzzy Hash: 108ae247cccad6efdf82b61b86059a5fc6fa1991ead362d0f7dc35f39638f920
Instruction Fuzzy Hash: 3FE065726411215AFB112B6A8C0CB977E5CDB527F9F22C135ED28D69A3CB62C84182F5

Non-executed Functions

Function 6CF3BBDA Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CF3BBE6
IsDebuggerPresent.KERNEL32 ref: 6CF3BCB2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CF3BCCB
UnhandledExceptionFilter.KERNEL32(?), ref: 6CF3BCD5

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cfb44875dad7ee428364f34de9a47f62e291623a13ec013d0d044a062a5a6351
Instruction ID: 4fe1edd338966307c9384e25c6287fb3224352365bebc242d91adb9e93a8e164
Opcode Fuzzy Hash: cfb44875dad7ee428364f34de9a47f62e291623a13ec013d0d044a062a5a6351
Instruction Fuzzy Hash: 8A31F975D15228EBDF60DFA4C9497CDBBB8BF08345F1055AAE40CAB340EB709A848F85

Function 6CF3FB77 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CF3FC6F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CF3FC79
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CF3FC86

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 070e04086f2b61a99fdf7de2fe284db0554f71735c44ff2962e8d5d8ff806b25
Instruction ID: cce1a780705fb739a80713d84f39605f4922c41196006011efae683b39400239
Opcode Fuzzy Hash: 070e04086f2b61a99fdf7de2fe284db0554f71735c44ff2962e8d5d8ff806b25
Instruction Fuzzy Hash: 5131F47091162CEBCB61DF28D8887CDBBB8BF08354F1055EAE81CA6250E7309B858F94

Function 6CF3ACE0 Relevance: 4.2, Strings: 3, Instructions: 467COMMONLIBRARYCODE

Download Yara Rule

Strings

y:pF, xrefs: 6CF3AFC4
y:pF, xrefs: 6CF3AF6A
vwP, xrefs: 6CF3B0D3

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID:
String ID: vwP$y:pF$y:pF
API String ID: 0-913257228
Opcode ID: c68895f817f32d502032dde508137a4f4c34adaca748a20d7f86779c88472320
Instruction ID: 583fd020fa6100f31460d2f8e4309fa05a3e4959eecdcb1378d2700efedbffb7
Opcode Fuzzy Hash: c68895f817f32d502032dde508137a4f4c34adaca748a20d7f86779c88472320
Instruction Fuzzy Hash: B7F12572A445269FCF04CEBDC5A43DF77F29B46314F21A605D428EBB94C62B8E098BD1

Function 6CF467C5 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CF467C0,?,?,00000008,?,?,6CF463C3,00000000), ref: 6CF469F2

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c5090a066b35cf352e457abe229a289034bbde9d354a310561203286fbb15b0e
Instruction ID: 891acbbd8b99b63f14f7a26bdb673acfde8b851b3eb024914c3d51e8431bdbf4
Opcode Fuzzy Hash: c5090a066b35cf352e457abe229a289034bbde9d354a310561203286fbb15b0e
Instruction Fuzzy Hash: 44B116326106099FE705CF28C486B957FA0FF45368F25C658F8A9CF6A2C375E992CB40

Function 6CF3BD98 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CF3BDAE

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: bb62abcb86578621df99160eb3dd0a5f31df82f4892c7a72cb8b92b67341451a
Instruction ID: d0ba51762f22850a493c9a098e1b57730d874f5432670d41563cbd56fadb615e
Opcode Fuzzy Hash: bb62abcb86578621df99160eb3dd0a5f31df82f4892c7a72cb8b92b67341451a
Instruction Fuzzy Hash: 6E51C0B1E216199FDF05CF59C8913AEB7F8FB49304F20996AC418EB690D3759940CFA0

Function 6CF40228 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4515731dc1941b46f90867f62efbca55fa45fd0c33fc09ef5c8e126dfd301a52
Instruction ID: 15d0a11da3d51d0325b94141e7ab37dfdc03698825c97a1af364510dcbe662a0
Opcode Fuzzy Hash: 4515731dc1941b46f90867f62efbca55fa45fd0c33fc09ef5c8e126dfd301a52
Instruction Fuzzy Hash: BB41C2B5805259AFDB10DF69CC88AEABBB8EF45308F1482DDE40DD3641DB349E848F60

Function 030134A8 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

==)6, xrefs: 0301354A

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: ==)6
API String ID: 0-2219475921
Opcode ID: 7918d06344ff2ea8891753728e93b064c2f8ab9ea5d5aecd5866ee5e4c5e3dc3
Instruction ID: e32b026edfdf11939c1a4e0e786a3848e416b3cdf1ce78d5d36eea85ecb2a31f
Opcode Fuzzy Hash: 7918d06344ff2ea8891753728e93b064c2f8ab9ea5d5aecd5866ee5e4c5e3dc3
Instruction Fuzzy Hash: E641D336A51601CFC765CF6DC885A5ABBF1FF84310B1488BAE06ACBA60D234F955CF41

Function 030134B8 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

==)6, xrefs: 0301354A

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID: ==)6
API String ID: 0-2219475921
Opcode ID: 93d9ced522f740ba5de4fbcfc052f0efefde506f18534930f0db2ae6399b24ac
Instruction ID: 010e1e29d93b280ce4d3c95b4aa399e30c523e1fab3305232973394192dd44a3
Opcode Fuzzy Hash: 93d9ced522f740ba5de4fbcfc052f0efefde506f18534930f0db2ae6399b24ac
Instruction Fuzzy Hash: 0D41C235A51615CFC765CB2EC485A1AFBF6FF84310B14C8BAE06ACBA64D234E961CF41

Function 6CF4194B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CF4194B

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 213fa02405cc3797db39cdd404d56bfdf801f12ad3181f7943b0da4eff9aa1bf
Instruction ID: de66ebc89f276c3b65ad4efaab4c36968c7c85bde3327dd97b44200ea189197c
Opcode Fuzzy Hash: 213fa02405cc3797db39cdd404d56bfdf801f12ad3181f7943b0da4eff9aa1bf
Instruction Fuzzy Hash: 2DA00170B25201CFAFD09F3A860A3097AFAAA9AA9574A806EA409C5151EA2585509F52

Function 03016708 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9754c4b9bbfe22454affc6afc825f3c9ba83774feb60251852655fc3192372
Instruction ID: e305f616a7c88eb6874cebbc43d952137bcd5e40a1d36c8e638a8dce4e035377
Opcode Fuzzy Hash: aa9754c4b9bbfe22454affc6afc825f3c9ba83774feb60251852655fc3192372
Instruction Fuzzy Hash: 32A10130B152198BCB15CB2CC89153EFBF6AFC5304B68C96AD856DB369C632ED61CB50

Function 030166F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbdd12a619638c5faeaaf7c3f281f99ccf428695788ad3e430938eb58a262d7
Instruction ID: deaab8941ff12c0348e1efe260f507dadcf399553ca515841ce18d8a04b57013
Opcode Fuzzy Hash: 3fbdd12a619638c5faeaaf7c3f281f99ccf428695788ad3e430938eb58a262d7
Instruction Fuzzy Hash: 83A11130B152198BCB15CB28C89157EFBF6EFC5304B28C96AD856DB369C232ED61CB50

Function 03014000 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb80cab7f255fe31cc55e4013f33ed7fb8da014b02e01cfc95b3b608fff7ac0
Instruction ID: 3b21c40fbd0d496d827c298500fbf1b40980cd51e8f0750d841f0ae606cd486c
Opcode Fuzzy Hash: cfb80cab7f255fe31cc55e4013f33ed7fb8da014b02e01cfc95b3b608fff7ac0
Instruction Fuzzy Hash: 9F419C35F1521A8FCB40CFABC8819AEFBB5FB89340B15C566D815EB720D235DA11CB91

Function 03014010 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036484667.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3010000_StrangeOstrumV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77997eb7742bac0f61e048b6130a0b673cfa8d0ded6fa19d605e64298e1b0ad2
Instruction ID: c756e2da39d2bdffaa2d054271703e8938455805ff4d3e20627f79d490d932c8
Opcode Fuzzy Hash: 77997eb7742bac0f61e048b6130a0b673cfa8d0ded6fa19d605e64298e1b0ad2
Instruction Fuzzy Hash: A441BC71F1121A8FCB44CFABC9819AEFBF5BB88340B55C426D815EB760D235D911CB91

Function 6CF3D60A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CF3D729
___TypeMatch.LIBVCRUNTIME ref: 6CF3D837
_UnwindNestedFrames.LIBCMT ref: 6CF3D989
CallUnexpected.LIBVCRUNTIME ref: 6CF3D9A4

Strings

csm, xrefs: 6CF3D760
csm, xrefs: 6CF3D647
csm, xrefs: 6CF3D6B4

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 04dd7cb4126d502cbb2dc4d9facd7df26411e0888793374ce00b23cfb3ed407d
Instruction ID: a01426b0547beb31003020d7c4aa15868be8d92c9894be5f610fcc6e4c0e3527
Opcode Fuzzy Hash: 04dd7cb4126d502cbb2dc4d9facd7df26411e0888793374ce00b23cfb3ed407d
Instruction Fuzzy Hash: EEB17B71811229FFCF09DFA4C880A9EBBB5BF44318B15625AE8186BB11D331EA55CFD1

Function 6CF3C6B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CF3C6E7
___except_validate_context_record.LIBVCRUNTIME ref: 6CF3C6EF
_ValidateLocalCookies.LIBCMT ref: 6CF3C778
__IsNonwritableInCurrentImage.LIBCMT ref: 6CF3C7A3
_ValidateLocalCookies.LIBCMT ref: 6CF3C7F8

Strings

csm, xrefs: 6CF3C78D

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 04b890bdc4b15dc4a795d310db3a6eea7813f04a32bd6257f3f587206d00d1e7
Instruction ID: 40cd77e81ea6a71bf7a1b988d71c27cad46eb7fdb881311ecae629e988dd5757
Opcode Fuzzy Hash: 04b890bdc4b15dc4a795d310db3a6eea7813f04a32bd6257f3f587206d00d1e7
Instruction Fuzzy Hash: EE417F34A00239ABCF00EF69C884ADEBBB5AF45328F149656ED189B791D731DA15CBD0

Function 6CF4157A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CF41689,00000000,6CF3EE90,00000000,00000000,00000001,?,6CF41802,00000022,FlsSetValue,6CF49898,6CF498A0,00000000), ref: 6CF4163B

Strings

ext-ms-, xrefs: 6CF415E5
api-ms-, xrefs: 6CF415D1

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: deb5326b53a8cd3eb2b0f99bd273326e71993ec202a7dd2bd44f97e8a5b79730
Instruction ID: f6f74b3cf222e02b782aa2c172517b42fa5f92949a379fc50743e5933a354330
Opcode Fuzzy Hash: deb5326b53a8cd3eb2b0f99bd273326e71993ec202a7dd2bd44f97e8a5b79730
Instruction Fuzzy Hash: DE212B31F15120ABDB119F659C40B8A3F799B42378F29C211E81AE7682DB30EE10C6D1

Function 6CF3CC5C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CF3C891,6CF3B9B0,6CF3B3C9,?,6CF3B601,?,00000001,?,?,00000001,?,6CF4D698,0000000C,6CF3B6FA), ref: 6CF3CC6A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CF3CC78
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CF3CC91
SetLastError.KERNEL32(00000000,6CF3B601,?,00000001,?,?,00000001,?,6CF4D698,0000000C,6CF3B6FA,?,00000001,?), ref: 6CF3CCE3

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a602f0be81e259d1af516e496e2958fefdd189c33b960172a4fff454180a2d93
Instruction ID: 78f15a140bf73a7f2986327ed634a56c48f8e4767b3f717bc6b01b97ee8b22ec
Opcode Fuzzy Hash: a602f0be81e259d1af516e496e2958fefdd189c33b960172a4fff454180a2d93
Instruction Fuzzy Hash: 2D01F532F392757EAA403A7EAC8474636A4EB437BD730232AE118A5AD0EF114C0482D4

Function 6CF407AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\StrangeOstrumV2.exe, xrefs: 6CF407CA

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\StrangeOstrumV2.exe
API String ID: 0-3601355902
Opcode ID: 9406b6158293816cc6c0414a1f25baf24769a3296bc730a3bb538e54f21e5cf5
Instruction ID: 323d63efa7b27d757550e0a612c301acf8c909534239a8d1d603809f2f413c45
Opcode Fuzzy Hash: 9406b6158293816cc6c0414a1f25baf24769a3296bc730a3bb538e54f21e5cf5
Instruction Fuzzy Hash: E521D432604285BF8700AF668D90D9B7FA9EF6132C705C924F919D7A42DBB0EC44CBD0

Function 6CF3E7BE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FD7CA857,00000000,?,00000000,6CF470C2,000000FF,?,6CF3E758,?,?,6CF3E72C,?), ref: 6CF3E7F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CF3E805
FreeLibrary.KERNEL32(00000000,?,00000000,6CF470C2,000000FF,?,6CF3E758,?,?,6CF3E72C,?), ref: 6CF3E827

Strings

mscoree.dll, xrefs: 6CF3E7EC
CorExitProcess, xrefs: 6CF3E7FD

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 68233c0ac0c84e3ce4a81ca2ed8f780c31e244249a6d98cc6a22702ef7436e88
Instruction ID: 3ecf9332fc056a9841082c7b15fd337d672fac6c4bbb17b5ac986dab403ee375
Opcode Fuzzy Hash: 68233c0ac0c84e3ce4a81ca2ed8f780c31e244249a6d98cc6a22702ef7436e88
Instruction Fuzzy Hash: 91014F31E21529EFDF11AF94CC04BAE7BB9FF05659F008526E821E2A91DB759900CAD0

Function 6CF43235 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CF432BA
__alloca_probe_16.LIBCMT ref: 6CF43383
__freea.LIBCMT ref: 6CF433EA

Part of subcall function 6CF423DA: RtlAllocateHeap.NTDLL(00000000,6CF40D27,6CF420F4,?,6CF40D27,00000220,?,?,6CF420F4), ref: 6CF4240C

__freea.LIBCMT ref: 6CF433FD
__freea.LIBCMT ref: 6CF4340A

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: b6a6a7fe6625ae2a5c313867cb8736d4673b53f70da48d6ed9aaf588ae60726b
Instruction ID: 1da23efc0ab472e8cf60452a56045d916131a18805c1abe51c7c04e2ff7df36a
Opcode Fuzzy Hash: b6a6a7fe6625ae2a5c313867cb8736d4673b53f70da48d6ed9aaf588ae60726b
Instruction Fuzzy Hash: F351B372601206ABEB114FA4CC41EFB3EBADF44618F21C128FD14D7A22EB30DD198660

Function 6CF3D232 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CF3D1E3,00000000,?,00000001,?,?,?,6CF3D2D2,00000001,FlsFree,6CF48F70,FlsFree), ref: 6CF3D23F
GetLastError.KERNEL32(?,6CF3D1E3,00000000,?,00000001,?,?,?,6CF3D2D2,00000001,FlsFree,6CF48F70,FlsFree,00000000,?,6CF3CD31), ref: 6CF3D249
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CF3D271

Strings

api-ms-, xrefs: 6CF3D256

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 3df4a6f5b78787e6ad38694b01ad16e316c959464556e25a6604a624e61fe917
Instruction ID: f792d9af7675f9d41f6b3b4d227ddef5d9fd203ace5eeee32fa351900053f9c5
Opcode Fuzzy Hash: 3df4a6f5b78787e6ad38694b01ad16e316c959464556e25a6604a624e61fe917
Instruction Fuzzy Hash: 6CE04F707A4204B7EF502AB2DC05B4D3F66AB12B59F209022F90DE88D3E772E85086D9

Function 6CF43942 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FD7CA857,00000000,00000000,?), ref: 6CF439A5

Part of subcall function 6CF4137C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF433E0,?,00000000,-00000008), ref: 6CF413DD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CF43BF7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CF43C3D
GetLastError.KERNEL32 ref: 6CF43CE0

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b13f720945e859294b9a5263217713a7e2d26fd77b4b794aebcc327318933a8e
Instruction ID: ff19131aa50a73224d717cc63c65b536109130b4f614b6436ad43e2da3cd20bd
Opcode Fuzzy Hash: b13f720945e859294b9a5263217713a7e2d26fd77b4b794aebcc327318933a8e
Instruction Fuzzy Hash: 23D16975E04258AFDF05CFA8C880AADBBB5FF09314F24816AE525EB752D730A949CB50

Function 6CF3D3B3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6CF3D47A
___AdjustPointer.LIBCMT ref: 6CF3D49D
___AdjustPointer.LIBCMT ref: 6CF3D539

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 086dd63d92777056c6588987b6e50a7aa256b4936262fc9aa34407b912987dc4
Instruction ID: d79c26ed2b31e8be0789701c5c35bbe5b652c0deaf8196aefba5e1aa41d16deb
Opcode Fuzzy Hash: 086dd63d92777056c6588987b6e50a7aa256b4936262fc9aa34407b912987dc4
Instruction Fuzzy Hash: 1851C072616626BFEB158F54D840BAA77B4EF01318F20552AE91D87B90E731F980CBD0

Function 6CF3FFC8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CF4137C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF433E0,?,00000000,-00000008), ref: 6CF413DD

GetLastError.KERNEL32 ref: 6CF4002C
__dosmaperr.LIBCMT ref: 6CF40033
GetLastError.KERNEL32(?,?,?,?), ref: 6CF4006D
__dosmaperr.LIBCMT ref: 6CF40074

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 128d8da02a5b0ddeec16886edeb0a7f640b6fedb5371308d6f20543810bf1b79
Instruction ID: 57304e5263e87a5f482ea733d5b020f40c32a3519589d5df93a3149989a612b4
Opcode Fuzzy Hash: 128d8da02a5b0ddeec16886edeb0a7f640b6fedb5371308d6f20543810bf1b79
Instruction Fuzzy Hash: 33210732604255BFDB10AF7A8890D9BBBB9FF5136D704C619E81D87E42D7B0EC448B90

Function 6CF4141F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CF41427

Part of subcall function 6CF4137C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CF433E0,?,00000000,-00000008), ref: 6CF413DD

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF4145F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CF4147F

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: ff2b63661a48e51b4104dded13db88c5d3bdb53599942a9d6c93bd32099d6965
Instruction ID: d2973622d880eb9f36ce77d231084426ff2c58267a1876e23f713d05e6d133a1
Opcode Fuzzy Hash: ff2b63661a48e51b4104dded13db88c5d3bdb53599942a9d6c93bd32099d6965
Instruction Fuzzy Hash: A0112BB2911A157FA71167B58C88DEF7D7CCF971AC310C116F802D1A42EB34DD5481B0

Function 6CF452B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CF44A76,00000000,00000001,00000000,?,?,6CF43D34,?,00000000,00000000), ref: 6CF452CD
GetLastError.KERNEL32(?,6CF44A76,00000000,00000001,00000000,?,?,6CF43D34,?,00000000,00000000,?,?,?,6CF442D7,00000000), ref: 6CF452D9

Part of subcall function 6CF4529F: CloseHandle.KERNEL32(FFFFFFFE,6CF452E9,?,6CF44A76,00000000,00000001,00000000,?,?,6CF43D34,?,00000000,00000000,?,?), ref: 6CF452AF

___initconout.LIBCMT ref: 6CF452E9

Part of subcall function 6CF45261: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CF45290,6CF44A63,?,?,6CF43D34,?,00000000,00000000,?), ref: 6CF45274

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CF44A76,00000000,00000001,00000000,?,?,6CF43D34,?,00000000,00000000,?), ref: 6CF452FE

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: dc42e1905c0f672fc36c0aa5e21abec89e71170d168544ba39ccf6b9861c34dd
Instruction ID: 8330a65218d838c8e6a4f2fd794d4430aa49673286d2b5c056f349e3bbb10a65
Opcode Fuzzy Hash: dc42e1905c0f672fc36c0aa5e21abec89e71170d168544ba39ccf6b9861c34dd
Instruction Fuzzy Hash: 6EF0A236610158BBCF922FA5DC04B993F77FB06765B158111FA1D95625C7328920DB90

Function 6CF3D9AF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CF3D9D4

Strings

MOC, xrefs: 6CF3D9E6
RCC, xrefs: 6CF3D9EE

Memory Dump Source

Source File: 00000000.00000002.2039470838.000000006CF31000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CF30000, based on PE: true

Associated: 00000000.00000002.2039456362.000000006CF30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039497561.000000006CF48000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF4F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039515330.000000006CF81000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2039589574.000000006CF9A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf30000_StrangeOstrumV2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 9525f503b853d0146b6bd4a4bcc4976b81cf258b138c1e0767af64a2a5ba9404
Instruction ID: 16e2b30fefac59afc8c835787731c469624533ac189cbce371badac3aab63982
Opcode Fuzzy Hash: 9525f503b853d0146b6bd4a4bcc4976b81cf258b138c1e0767af64a2a5ba9404
Instruction Fuzzy Hash: CF419C71904229BFCF0ACF98CD80AEE7BB5FF48708F149159F918A7612D3359950DBA0

Analysis Process: MSBuild.exePID: 368, Parent PID: 6508COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	9

Executed Functions

Function 00F8D0A8 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F8D136
GetCurrentThread.KERNEL32 ref: 00F8D173
GetCurrentProcess.KERNEL32 ref: 00F8D1B0
GetCurrentThreadId.KERNEL32 ref: 00F8D209

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cfdc2a0c0b4f7ad8989a2c7f9cae22eba14fb65e7395e9f0696e79b127effd06
Instruction ID: a4b8134dd72a5bbb7657b8c93854d460d997102da207530e18046503fee77c4d
Opcode Fuzzy Hash: cfdc2a0c0b4f7ad8989a2c7f9cae22eba14fb65e7395e9f0696e79b127effd06
Instruction Fuzzy Hash: 075166B0D006098FDB04DFA9D94879EBBF1EF88314F208459E409A73A1DB34A985CB25

Function 00F8D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F8D136
GetCurrentThread.KERNEL32 ref: 00F8D173
GetCurrentProcess.KERNEL32 ref: 00F8D1B0
GetCurrentThreadId.KERNEL32 ref: 00F8D209

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ab738efd0a4da947361cbce8a4bad6a24d1b736cad386a6885d5389a85d0a19f
Instruction ID: 9cb45b584d4445dae843ee4b98921a4abd15386bf03f731cb4342513d55af946
Opcode Fuzzy Hash: ab738efd0a4da947361cbce8a4bad6a24d1b736cad386a6885d5389a85d0a19f
Instruction Fuzzy Hash: D95159B0D007098FDB14DFA9D948BDEBBF1EF88314F208459E419A73A0DB74A945CB65

Function 00F8AE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8B086

Strings

U, xrefs: 00F8AFBE
U, xrefs: 00F8AFE3

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID: U$U
API String ID: 4139908857-3302002139
Opcode ID: b45858d8aa3381b84b6bc27d9f744ba1f645d60840ccea74f1b80b4270ccc8db
Instruction ID: ac342eda1974d392928508c980412cac883c438f31cc83a758f09d86b330d826
Opcode Fuzzy Hash: b45858d8aa3381b84b6bc27d9f744ba1f645d60840ccea74f1b80b4270ccc8db
Instruction Fuzzy Hash: 7D714AB0A00B058FE724EF2AD44579ABBF1FF88310F10892EE446D7A50D775E946DB91

Function 00F85935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859F1

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0d694b8c53762bc8451ab92ffdd1ffb62199b86d57ccb82779b365093b7db01a
Instruction ID: 04b855a2beb998d5c02afb72c4c950b889478902b49ff4a42b451532dacfc1ca
Opcode Fuzzy Hash: 0d694b8c53762bc8451ab92ffdd1ffb62199b86d57ccb82779b365093b7db01a
Instruction Fuzzy Hash: 1A41EEB0D00619CFDB24DFA9C884ADEBBB5FF49704F20816AD408AB251DB75694ACF91

Function 00F84248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859F1

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d5e815b8b5428a3963d47a41fdc98b848c18a03285ff4cfcb225ac4539e94272
Instruction ID: bd613aad84a5c251e9659ca78c3b003e4aeed06ed293a6739ff48854a266322d
Opcode Fuzzy Hash: d5e815b8b5428a3963d47a41fdc98b848c18a03285ff4cfcb225ac4539e94272
Instruction Fuzzy Hash: B341DFB0D00619CBDB24DFA9C884BCEBBB5FF49704F20816AD408AB255DB75A949CF91

Function 00F8D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F8D387

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5793e10e1610f3755ed1cfcb464604fb8857c23547fa1fb80e08d5b2c17204b2
Instruction ID: 18be361bde86fbba9ac55c6983b2d99588e4cd73a2dc6aea2de5a42c48166a17
Opcode Fuzzy Hash: 5793e10e1610f3755ed1cfcb464604fb8857c23547fa1fb80e08d5b2c17204b2
Instruction Fuzzy Hash: D921E4B5D002099FDB10CF9AD484ADEBBF8EB48310F14841AE918A3350C374A954CFA5

Function 00F8D2F9 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F8D387

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5bf2dc2ca8bf5642db2028edd38174f642393653a394d93561736783353ee959
Instruction ID: cd226663d8c8c8cc2a8bd7e39aca54ea3fa49a6bf48ae245e267bd32ed0ec305
Opcode Fuzzy Hash: 5bf2dc2ca8bf5642db2028edd38174f642393653a394d93561736783353ee959
Instruction Fuzzy Hash: DA21F3B5D00209DFDB10CFA9E584ADEBBF5FB48310F14841AE918A3351C374A954CF65

Function 00F8A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F8B101,00000800,00000000,00000000), ref: 00F8B312

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5e9b126c5c8015771dbadc3837baa30ce8ee26bcddfc7cee3c5b4ea50d768d08
Instruction ID: 1daff7dce724285442475f23c0105faa41b36b577ca6ecc3681b614ef8835f48
Opcode Fuzzy Hash: 5e9b126c5c8015771dbadc3837baa30ce8ee26bcddfc7cee3c5b4ea50d768d08
Instruction Fuzzy Hash: E11103B6D003498FCB20DF9AD444ADEFBF4EB88321F10842AE419A7211C375A945CFA5

Function 00F8B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F8B101,00000800,00000000,00000000), ref: 00F8B312

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5b3524e0292a7f1c7427358e861790a6bff99a661d79eac138828afb5f42fb3a
Instruction ID: 0a66053f8581ea208b9f5fabf73e54967244ade473fe98f5bfd4ead5734c3546
Opcode Fuzzy Hash: 5b3524e0292a7f1c7427358e861790a6bff99a661d79eac138828afb5f42fb3a
Instruction Fuzzy Hash: E411E2B6D003498FDB20DF9AD444ADEFBF4EB88320F10842AD529A7650C379A945CFA5

Function 00F8B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8B086

Memory Dump Source

Source File: 00000003.00000002.2131324141.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f80000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 268778125e727e68481269bfff25712f9c17a3ad33be987e70122c8f1e3a28f7
Instruction ID: 6c718c61e4fd311e5ae20c73395624467549483b4ef40d7c0bc2167e8eda1201
Opcode Fuzzy Hash: 268778125e727e68481269bfff25712f9c17a3ad33be987e70122c8f1e3a28f7
Instruction Fuzzy Hash: 6D11E0B5D003498FCB20DF9AD444ADEFBF4EB89320F10841AD429B7611D375A549CFA5

Function 00E4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131001207.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c47e704327e3db4e10ef6fb204106192c29bbc0d92c93751c70a228f2cbb3b
Instruction ID: df9f8db610f2f2176806c796ea0082a30993ee8f64ca2a519bb6b4cbebc0d469
Opcode Fuzzy Hash: b8c47e704327e3db4e10ef6fb204106192c29bbc0d92c93751c70a228f2cbb3b
Instruction Fuzzy Hash: CC2125B1608240DFDB05DF14EDC0B26BF65FB98318F34C569E9091B256C73AD816CAA1

Function 00E4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131001207.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e8c1bc95c2971234e7ee2c3f19ba3968471156e2a0821977fc31be6e1fbbc4
Instruction ID: 3d3c52011a64d00e26b719dac1a096b8b7d2d79650f32fcb3f234354b4ed9189
Opcode Fuzzy Hash: 46e8c1bc95c2971234e7ee2c3f19ba3968471156e2a0821977fc31be6e1fbbc4
Instruction Fuzzy Hash: 242128B1508204DFDB05DF14EDC0B16BF65FB94324F24C56DE9095B256C33AE856C6A1

Function 00E5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131039716.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fc0eaf9350fd7f4dcb634b5a96d484f91f4dbb61cd42356e209958050fabda
Instruction ID: 2b7e7ce3c03d3623e65147209c9f1d3936367e9b20d1c69f0b9bdebd74f1e446
Opcode Fuzzy Hash: 69fc0eaf9350fd7f4dcb634b5a96d484f91f4dbb61cd42356e209958050fabda
Instruction Fuzzy Hash: D821F571508240DFDB24DF14D9C4B16BB66EB84319F34C96DDD0A5B296C33AD80BCA61

Function 00E5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131039716.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e5d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9224bf32133ea0c5b9f4639f4abd2b0626ff5c722269f7887d742ce1865a527c
Instruction ID: 528ff6f69d21ba23cc36b428d2da720aa23deb7939229c7b6c7a5951ba3a4ccb
Opcode Fuzzy Hash: 9224bf32133ea0c5b9f4639f4abd2b0626ff5c722269f7887d742ce1865a527c
Instruction Fuzzy Hash: 1A21537550D3808FDB12CF24D994715BF71EB46314F28C5EAD8498B6A7C33A980ACB62

Function 00E4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131001207.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: d6762d15ee1cc1527c4845aa5d80ce91a09c1b4763ca8c5f2db4987071c37187
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: B8112676404240CFCB12CF10E9C4B16BF71FB94324F24C2A9D8090B656C33AE85ACBA1

Function 00E4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2131001207.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 198981087ae77ad3f41f5d87fab690c5ec5c8fdf58fe61f405777c2fa953e5ee
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 5711E976504240CFCB15CF14E9C4B16BF71FB94318F24C5A9D8494B656C33AD456CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StrangeOstrumV2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\StrangeOstrumV2.exe.log

C:\Users\user\AppData\Roaming\d3d9.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
StrangeOstrumV2.exe

Function 6CF328C0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 457
COMMON

Function 03012187 Relevance: 3.0, Strings: 2, Instructions: 450
COMMON

Function 03012AD0 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Function 03012BB8 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Function 03011810 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Function 0301182F Relevance: 2.7, Strings: 2, Instructions: 176
COMMON

Function 030118A8 Relevance: 2.6, Strings: 2, Instructions: 125
COMMON

Function 6CF3B4F8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CF3B5A8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 03010A6E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Function 03010AA9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 192
memoryCOMMON

Function 6CF3B3F1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CF41A1C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 030108E2 Relevance: 1.7, APIs: 1, Instructions: 220
COMMON